Eric WagonerandClaude Fable 5
f62fcf2510
Security review of the accumulator commit found three holes, all in the unauthenticated hotseat ping. Worst: Number(undefined) is NaN, and NaN survives Math.min/max — one malformed report would have poisoned commandsPlayed and friends permanently (NaN serializes to null). All numeric fields now pass through a NaN-proof clamp with a fallback. The dedupe ledger caps at 50k hotseat entries so spammed random ids cannot grow stats.json without bound, and each connection may deliver at most 20 reports — a real device finishes a handful of games; a firehose is abuse. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>