William DrakeandClaude Opus 5.5 cf19f30d26 fix(payment): rate-limit anonymous public order verify endpoint ...

POST /api/v1/payment/public/orders/verify is unauthenticated and still used
by PaymentResultView as a fallback, so keep it but cap it at 20 req/min per
client IP (fail-open on Redis errors) to make out_trade_no enumeration
impractical without affecting users mid-payment.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-09-28 12:03:17 -04:00

..

config

…

domain

…

handler

Merge pull request #7526 from HuntercodeT/fix/passthrough-model-discovery-merge

2026-09-28 10:49:01 +08:00

integration

…

middleware

…

model

…

payment

…

pkg

Merge pull request #7638 from Achordchan/fix/anthropic-structured-output-beta

2026-09-28 10:52:52 +08:00

platform/liveattestation

…

repository

…

securityaudit

…

server

fix(payment): rate-limit anonymous public order verify endpoint

2026-09-28 12:03:17 -04:00

service

Merge pull request #7638 from Achordchan/fix/anthropic-structured-output-beta

2026-09-28 10:52:52 +08:00

setup

…

testutil

…

util

…

web

…