fix: 3 security vulnerabilities — XSS in faucet & ledger, anti-Sybil bypass in airdrop

faucet.py

@@ -241,18 +241,36 @@ def record_drip(wallet, ip_address, amount):
                 const data = await response.json();
 
                 if (data.ok) {
-                    result.innerHTML = '<div class="result success">✅ Success! Sent ' + data.amount + ' RTC to ' + wallet + '</div>';
+                    result.textContent = '';
+                    const successDiv = document.createElement('div');
+                    successDiv.className = 'result success';
+                    successDiv.textContent = '✅ Success! Sent ' + data.amount + ' RTC to ' + wallet;
+                    result.appendChild(successDiv);
                     if (data.next_available) {
-                        result.innerHTML += '<div class="result info">Next available: ' + data.next_available + '</div>';
+                        const infoDiv = document.createElement('div');
+                        infoDiv.className = 'result info';
+                        infoDiv.textContent = 'Next available: ' + data.next_available;
+                        result.appendChild(infoDiv);
                     }
                 } else {
-                    result.innerHTML = '<div class="result error">❌ ' + data.error + '</div>';
+                    result.textContent = '';
+                    const errorDiv = document.createElement('div');
+                    errorDiv.className = 'result error';
+                    errorDiv.textContent = '❌ ' + data.error;
+                    result.appendChild(errorDiv);
                     if (data.next_available) {
-                        result.innerHTML += '<div class="result info">Next available: ' + data.next_available + '</div>';
+                        const infoDiv = document.createElement('div');
+                        infoDiv.className = 'result info';
+                        infoDiv.textContent = 'Next available: ' + data.next_available;
+                        result.appendChild(infoDiv);
                     }
                 }
             } catch (err) {
-                result.innerHTML = '<div class="result error">❌ Error: ' + err.message + '</div>';
+                result.textContent = '';
+                const errDiv = document.createElement('div');
+                errDiv.className = 'result error';
+                errDiv.textContent = '❌ Error: ' + err.message;
+                result.appendChild(errDiv);
             }
 
             submitBtn.disabled = false;

node/airdrop_v2.py

@@ -1234,7 +1234,8 @@ def check_airdrop_eligibility():
         wallet_address = data.get("wallet_address", "").strip()
         chain = data.get("chain", "").strip()
         github_token = data.get("github_token")
-        skip_antisybil = data.get("skip_antisybil", False)
+        # SECURITY: skip_antisybil must NEVER be settable from API requests.
+        # It exists only for internal testing via direct Python calls.
 
         if not github_username:
             return jsonify({"ok": False, "error": "missing_github_username"}), 400
@@ -1244,7 +1245,7 @@ def check_airdrop_eligibility():
             return jsonify({"ok": False, "error": "missing_chain"}), 400
 
         result = airdrop.check_eligibility(
-            github_username, wallet_address, chain, github_token, skip_antisybil
+            github_username, wallet_address, chain, github_token, skip_antisybil=False
         )
 
         return jsonify({"ok": result.eligible, **result.to_dict()})

payout_ledger.py

@@ -254,12 +254,12 @@ def api_ledger_summary():
 <tr><th>Bounty</th><th>Contributor</th><th>RTC</th><th>Status</th><th>PR</th><th>TX</th><th>Date</th></tr>
 {% for r in records %}
 <tr>
-  <td>{{ r.bounty_id }} {{ r.bounty_title }}</td>
-  <td>{{ r.contributor }}</td>
+  <td>{{ r.bounty_id|e }} {{ r.bounty_title|e }}</td>
+  <td>{{ r.contributor|e }}</td>
   <td>{{ "%.1f"|format(r.amount_rtc) }}</td>
-  <td class="status-{{ r.status }}">{{ r.status }}</td>
-  <td>{% if r.pr_url %}<a href="{{ r.pr_url }}" target="_blank">PR</a>{% endif %}</td>
-  <td>{{ r.tx_hash[:12] if r.tx_hash else '' }}</td>
+  <td class="status-{{ r.status|e }}">{{ r.status|e }}</td>
+  <td>{% if r.pr_url %}<a href="{{ r.pr_url|e }}" target="_blank">PR</a>{% endif %}</td>
+  <td>{{ r.tx_hash[:12]|e if r.tx_hash else '' }}</td>
   <td>{{ r.created_at }}</td>
 </tr>
 {% endfor %}