wizwar6e

T

Eric WagonerandClaude Fable 5 0221e91ba3 Hash seat tokens at rest (security review finding)

Raw seat tokens no longer touch disk or long-lived memory: rooms store
sha-256 hashes, joins compare timing-safely, sessions keep the raw
token they authenticated with only for minting transfer phrases, and
legacy plaintext room files still load (hashed on read). Verified:
rejoin and transfer both work, and the room file contains only
hostTokenHash — no raw token anywhere.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-16 00:03:36 -04:00

packages

Hash seat tokens at rest (security review finding)

2026-08-16 00:03:36 -04:00

research

Correct 21 more Expansion #1 cards from photos of the card faces

2026-08-15 22:33:03 -04:00

.gitignore

Persistent games: rooms survive server restarts by log replay

2026-08-15 23:46:23 -04:00

package-lock.json

Scaffold monorepo: engine, server, and web packages