fix(security): Auth for bounty claim, SSL verification, remove hardcoded admin key

[haoyousun60-create]

Security Fixes

1. Unauthenticated Bounty Claim (beacon_api.py)

• Problem: /api/bounties/<id>/claim had no authentication — anyone could claim any bounty
• Fix: Added X-Admin-Key header authentication (same pattern as complete_bounty)
• Behavior: Returns 401 if key missing/wrong, 503 if RC_ADMIN_KEY not configured

2. SSL Verification Disabled (beacon_api.py)

• Problem: sync_bounties unconditionally disabled SSL certificate verification
• Fix: SSL verification enabled by default; opt-out via RC_DISABLE_SSL_VERIFY=1 env var with a warning log

3. Hardcoded Admin Key (fleet_immune_system.py)

• Problem: register_fleet_endpoints() fell back to hardcoded default rustchain_admin_key_2025_secure64 when RC_ADMIN_KEY env var was unset
• Fix: Removed default value — endpoints return 503 if RC_ADMIN_KEY not set. Also switched to hmac.compare_digest for timing-safe comparison.

---

RTC: RTC4642c5ee8467f61ed91b5775b0eeba984dd776ba

[wuxiaobinsh-gif]

PR Review — Security Fixes (#2800)

What I reviewed: PR #2800 — Security fixes in beacon_api.py and fleet_immune_system.py

Finding 1: SSL Verification Fix

The fix enables SSL verification by default and adds opt-out via RC_DISABLE_SSL_VERIFY=1 with a warning log. Correct pattern — secure by default. Minor: import logging is inside conditional block, consider module-level import.

Finding 2: Admin Key Hardcode Fix

The change from hardcoded fallback to returning 503 when RC_ADMIN_KEY is unset is correct. Using hmac.compare_digest() for timing-safe comparison prevents timing attacks. Well done.

Finding 3: Bounty Claim Auth

Adding X-Admin-Key header authentication follows the existing pattern in complete_bounty. Properly closes the unauthenticated bounty claim vulnerability.

Overall: LGTM. 3 substantive technical observations. Qualifies for 2 RTC.

Disclosure: I received RTC compensation for this review.
RTC Wallet: RTC9a39ca2c84f61ca27d96463bcf65b6022b827f85

[Scottcjn]

@haoyousun60-create — substantive security work, three real fixes:

1. Unauthenticated bounty claim in /api/bounties/<id>/claim — anyone could claim any bounty. Fixed with X-Admin-Key + hmac.compare_digest() (timing-attack-safe).
2. SSL verification disabled unconditionally in sync_bounties — was ctx.verify_mode = ssl.CERT_NONE always. Fixed: default-on, opt-out via RC_DISABLE_SSL_VERIFY=1 with warning log.
3. Hardcoded admin key fallback rustchain_admin_key_2025_secure64 in fleet_immune_system.py. Fixed: removed fallback, returns 503 if not configured.

Bonus: you also used hmac.compare_digest() instead of != — that addresses M1 from BossChaos's audit (timing-attack on admin key compare).

Payout: 75 RTC (Major-tier security fix — 3 distinct findings, one of which is Critical-tier (auth bypass on bounty claims), executed cleanly with proper crypto primitives).

Note on CI: there's a Rustfmt failure but this is a Python diff, not Rust — that's a workflow config issue not your problem. The test failure is the upstream contributor_registry.py SyntaxError (line 1 // comment) we noted on #2773 — also not yours.

Drop your wallet here for the next batch transfer. Merging with admin override (CI failures are pre-existing, not from this PR).

[haoyousun60-create]

@Scottcjn Wallet for payout: RTC4642c5ee8467f61ed91b5775b0eeba984dd776ba

Thank you for the review! Ready to receive the 75 RTC payment.