Replace all dynamic .split() patterns in subprocess calls with safe
alternatives: shlex.split(), explicit list args, and _run_btc/_run_ln
helpers in PyBlock.py. Covers PyBlock, block_visualizer, clockscript,
lastblockdetail, mempoolclock, nodeconnection, and ai/context.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Replace open() without context managers with `with` statements across all modified files
- Change bare `except:` to `except Exception:` for safer exception handling
- Move Whale Alert API key from hardcoded to environment variable
- Use raw strings for ASCII art to prevent escape sequence issues
- Simplify image file handling in nodeconnection.py
- Convert unsafe shell subprocess calls to list-based format
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace insecure patterns that exposed the application to command injection,
arbitrary code execution, and data interception attacks.
- Replace os.popen/os.system with subprocess.run using argument lists
- Migrate pickle config serialization to JSON format
- Replace bare except: blocks with specific exception types
- Fix insecure HTTP URLs to HTTPS (opreturnbot.com, ascii.live)
- Replace shell curl commands with requests library calls
- Add migrate_config.py script for pickle-to-JSON config migration
- Convert existing SPV config files to JSON format
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
