- Replace all shell=True subprocess calls with Python-native processing
(nodeconnection.py, SPV/nodeconnection.py, SPV/ppi.py)
- Mask sensitive inputs (private keys, passwords, tokens) with getpass
- Add threading.Lock to block_explorer.py shared state
- Use json.loads() instead of fragile string splitting in apisnd.py
- Add path validation before file open in apisnd.py
- Replace random.randint with secrets.randbelow for mining nonces
- Fix destructive exception handlers in clone.py and feed.py
- Replace bare except clauses with specific exceptions + logging
- Remove unused imports (psutil, xmltodict, block_visualizer, base64, say)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace insecure patterns that exposed the application to command injection,
arbitrary code execution, and data interception attacks.
- Replace os.popen/os.system with subprocess.run using argument lists
- Migrate pickle config serialization to JSON format
- Replace bare except: blocks with specific exception types
- Fix insecure HTTP URLs to HTTPS (opreturnbot.com, ascii.live)
- Replace shell curl commands with requests library calls
- Add migrate_config.py script for pickle-to-JSON config migration
- Convert existing SPV config files to JSON format
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
