you 2170dd7743 security: require API key for POST /api/packets and /api/perf/reset ...

- New config.apiKey field — when set, POST endpoints require X-Api-Key header
- If apiKey not configured, endpoints remain open (dev/local mode)
- GET endpoints and /api/decode (read-only) remain public
- Closes the packet injection attack surface

2026-03-21 18:40:06 +00:00

2.6 KiB

Raw Blame History

View Raw