Security fix for Agentic-Telegram-TMA (Telegram Mini App, Cloudflare Workers). Confirmed and fixed a gap where /api/profile and /api/mission-log had no auth, allowing any user to read/overwrite another user's profile via userId guessing. Fix is committed locally on branch fix/gate-profile-mission-log-auth in Cybersoulja/Agentic-Telegram-TMA — not yet pushed or opened as a PR, pending go-ahead. Related to PR #14 which merged the corrected security report.

Source: ‣