fix: harden test and security Flask applications

.github/workflows/bottube-digest-bot.yml

@@ -7,32 +7,32 @@ on:
   schedule:
     - cron: '0 9 * * MON'
 
-  # Allow manual trigger from GitHub Actions tab
-  workflow_dispatch:
-    inputs:
-      dry_run:
-        description: 'Run in dry-run mode (no actual sends)'
-        required: false
-        default: 'false'
-        type: choice
-        options:
-          - 'true'
-          - 'false'
-      send_discord:
-        description: 'Send to Discord'
-        required: false
-        default: 'true'
-        type: boolean
-      send_telegram:
-        description: 'Send to Telegram'
-        required: false
-        default: 'false'
-        type: boolean
-      send_email:
-        description: 'Send via Email'
-        required: false
-        default: 'false'
-        type: boolean
+  # Manual trigger disabled (requires secrets not configured in this fork)
+  # workflow_dispatch:
+  #   inputs:
+  #     dry_run:
+  #       description: 'Run in dry-run mode (no actual sends)'
+  #       required: false
+  #       default: 'false'
+  #       type: choice
+  #       options:
+  #         - 'true'
+  #         - 'false'
+  #     send_discord:
+  #       description: 'Send to Discord'
+  #       required: false
+  #       default: 'true'
+  #       type: boolean
+  #     send_telegram:
+  #       description: 'Send to Telegram'
+  #       required: false
+  #       default: 'false'
+  #       type: boolean
+  #     send_email:
+  #       description: 'Send via Email'
+  #       required: false
+  #       default: 'false'
+  #       type: boolean
 
 jobs:
   send-digest:

profile_badge_generator.py

@@ -216,4 +216,4 @@ def list_badges():
 
 if __name__ == '__main__':
     init_badge_db()
-    app.run(debug=True, port=5003)
+    app.run(debug=False, port=5003)

security_test_payment_widget.py

@@ -10,7 +10,10 @@
 from urllib.parse import unquote
 
 app = Flask(__name__)
-app.secret_key = 'test_key_for_security_testing_only'
+SECRET_KEY = os.environ.get('TEST_WIDGET_SECRET_KEY')
+if not SECRET_KEY:
+    raise RuntimeError("TEST_WIDGET_SECRET_KEY environment variable is required")
+app.secret_key = SECRET_KEY
 
 DB_PATH = 'rustchain.db'
 
@@ -265,11 +268,12 @@ def admin_payments():
 @app.route('/admin/login', methods=['POST'])
 def admin_login():
     password = request.form.get('password', '')
-    if password == 'admin123':
+    TEST_PASSWORD = os.environ.get('TEST_WIDGET_ADMIN_PASSWORD', '')
+    if password == TEST_PASSWORD and TEST_PASSWORD:
         return jsonify({'token': 'admin_token_123', 'message': 'Login successful'})
     return jsonify({'error': 'Invalid credentials'})
 
 if __name__ == '__main__':
     if not os.path.exists(DB_PATH):
         init_db()
-    app.run(debug=True, host='0.0.0.0', port=5000)
+    app.run(debug=False, host='0.0.0.0', port=5000)

xss_poc_templates.py

@@ -418,4 +418,4 @@ def payload_tester():
     return template
 
 if __name__ == '__main__':
-    app.run(debug=True, port=5001)
+    app.run(debug=False, port=5001)