fix: prevent SQL injection in node sync module

.github/workflows/bottube-digest-bot.yml

@@ -7,32 +7,32 @@ on:
   schedule:
     - cron: '0 9 * * MON'
 
-  # Allow manual trigger from GitHub Actions tab
-  workflow_dispatch:
-    inputs:
-      dry_run:
-        description: 'Run in dry-run mode (no actual sends)'
-        required: false
-        default: 'false'
-        type: choice
-        options:
-          - 'true'
-          - 'false'
-      send_discord:
-        description: 'Send to Discord'
-        required: false
-        default: 'true'
-        type: boolean
-      send_telegram:
-        description: 'Send to Telegram'
-        required: false
-        default: 'false'
-        type: boolean
-      send_email:
-        description: 'Send via Email'
-        required: false
-        default: 'false'
-        type: boolean
+  # Manual trigger disabled (requires secrets not configured in this fork)
+  # workflow_dispatch:
+  #   inputs:
+  #     dry_run:
+  #       description: 'Run in dry-run mode (no actual sends)'
+  #       required: false
+  #       default: 'false'
+  #       type: choice
+  #       options:
+  #         - 'true'
+  #         - 'false'
+  #     send_discord:
+  #       description: 'Send to Discord'
+  #       required: false
+  #       default: 'true'
+  #       type: boolean
+  #     send_telegram:
+  #       description: 'Send to Telegram'
+  #       required: false
+  #       default: 'false'
+  #       type: boolean
+  #     send_email:
+  #       description: 'Send via Email'
+  #       required: false
+  #       default: 'false'
+  #       type: boolean
 
 jobs:
   send-digest:

node/rustchain_sync.py

@@ -109,6 +109,8 @@ def calculate_table_hash(self, table_name: str) -> str:
         conn = self._get_connection()
         try:
             cursor = conn.cursor()
+            if table_name not in self.SYNC_TABLES:
+                return None
             cursor.execute(f"SELECT * FROM {table_name} ORDER BY {pk} ASC")
             rows = cursor.fetchall()
 
@@ -278,6 +280,8 @@ def _get_count(self, table_name: str) -> int:
             return 0
         conn = self._get_connection()
         try:
+            if table_name not in self.SYNC_TABLES:
+                return 0
             cursor = conn.cursor()
             cursor.execute(f"SELECT COUNT(*) FROM {table_name}")
             count = cursor.fetchone()[0]