1. [security] `apps/spinel/patches/2-tep-bakeoff.patch:152` — The five-second timeout applies separately to each socket read. A client sending another body byte every four seconds can occupy the sole worker for hours, blocking every visitor. Enforce a deadline for the entire request.
2
3
2. [correctness] `apps/spinel/.cache/x86/tep/tep/sphttp.c:254` — The dependency’s body reader silently caps each drain at 65,535 bytes, and `consume_body` calls it only once. A 10,000-emoji title encodes to about 120,000 bytes; sending headers before the body causes the title to be truncated and saved with a success response. Patch the dependency to read complete bodies, support the required title length, and reject incomplete requests before mutation.
4
5
3. [spec] `apps/spinel/app.rb:203` — Any syntactically valid 22-character cookie is accepted without checking whether the server issued it. An unknown `tid=AAAAAAAAAAAAAAAAAAAAAA` remains the list identifier, and separate clients supplying it share subsequent todos. Track issued tokens and replace unrecognised values with fresh random cookies.
6
7
4. [spec] `apps/spinel/patches/2-tep-bakeoff.patch:21` — `--listen` accepts arbitrary addresses, including `0.0.0.0`; omitting the listener also retains Tep’s wildcard-binding fallback. This violates the loopback-only requirement. Reject non-loopback addresses and require a valid socket or loopback listener.
amadan