From b4110c3d6687c0565de26f92e62b7247f7d8ce9e Mon Sep 17 00:00:00 2001 From: TheOnlyMace <0815cracky@gmail.com> Date: Tue, 21 Jul 2026 17:11:38 +0200 Subject: [PATCH] Update project configuration files, and API routes accordingly. Add SQLite runtime file ignores to .gitignore for better file management. --- .github/workflows/ci.yml | 76 +++++ .gitignore | 4 + PROJEKT_ANALYSE.md | 30 +- PR_DESCRIPTION.md | 2 +- README.md | 47 ++- SECURITY_FIXES.md | 22 +- bot/.env.example | 11 +- bot/{CodeX.py => HexaHost.py} | 26 +- bot/LICENSE | 2 +- bot/README.md | 43 ++- bot/api/__init__.py | 13 +- bot/api/db_manager.py | 16 +- bot/api/dependencies.py | 25 +- bot/api/discord_auth.py | 11 +- bot/api/routes/__init__.py | 13 +- bot/api/routes/admin.py | 20 +- bot/api/routes/bot.py | 19 +- bot/api/routes/guilds.py | 104 +++--- bot/api/schemas.py | 13 +- bot/api/server.py | 17 +- bot/cogs/__init__.py | 321 ++++-------------- bot/cogs/antinuke/antiIntegration.py | 20 +- bot/cogs/antinuke/anti_member_update.py | 20 +- bot/cogs/antinuke/antiban.py | 16 +- bot/cogs/antinuke/antibotadd.py | 16 +- bot/cogs/antinuke/antichcr.py | 16 +- bot/cogs/antinuke/antichdl.py | 16 +- bot/cogs/antinuke/antichup.py | 16 +- bot/cogs/antinuke/antieveryone.py | 16 +- bot/cogs/antinuke/antiguild.py | 20 +- bot/cogs/antinuke/antikick.py | 20 +- bot/cogs/antinuke/antiprune.py | 16 +- bot/cogs/antinuke/antirlcr.py | 20 +- bot/cogs/antinuke/antirldl.py | 20 +- bot/cogs/antinuke/antirlup.py | 20 +- bot/cogs/antinuke/antiwebhook.py | 20 +- bot/cogs/antinuke/antiwebhookcr.py | 20 +- bot/cogs/antinuke/antiwebhookdl.py | 20 +- .../extra events (unused)/antiemocr.py | 3 +- .../extra events (unused)/antiemodl.py | 3 +- .../extra events (unused)/antiemoup.py | 3 +- .../extra events (unused)/antisticker.py | 3 +- .../extra events (unused)/antiunban.py | 3 +- bot/cogs/automod/anti_emoji_spam.py | 26 +- bot/cogs/automod/anti_invites.py | 26 +- bot/cogs/automod/anti_mass_mention.py | 26 +- bot/cogs/automod/anticaps.py | 26 +- bot/cogs/automod/antilink.py | 26 +- bot/cogs/automod/antispam.py | 26 +- bot/cogs/commands/Birthday.py | 34 +- bot/cogs/commands/Embed.py | 13 +- bot/cogs/commands/Games.py | 19 +- bot/cogs/commands/Invc.py | 16 +- bot/cogs/commands/Media.py | 36 +- bot/cogs/commands/afk.py | 16 +- bot/cogs/commands/ai.py | 22 +- bot/cogs/commands/anti_unwl.py | 16 +- bot/cogs/commands/anti_wl.py | 16 +- bot/cogs/commands/antinuke.py | 16 +- bot/cogs/commands/automod.py | 50 +-- bot/cogs/commands/autoreact.py | 16 +- bot/cogs/commands/autoresponder.py | 16 +- bot/cogs/commands/autorole.py | 16 +- bot/cogs/commands/blackjack.py | 13 +- bot/cogs/commands/blacklist.py | 16 +- bot/cogs/commands/block.py | 28 +- bot/cogs/commands/booster.py | 22 +- bot/cogs/commands/calc.py | 13 +- bot/cogs/commands/counting.py | 16 +- bot/cogs/commands/customrole.py | 20 +- bot/cogs/commands/dms.py | 13 +- bot/cogs/commands/emergency.py | 24 +- bot/cogs/commands/encryption.py | 13 +- bot/cogs/commands/extra.py | 18 +- bot/cogs/commands/extraown.py | 16 +- bot/cogs/commands/fastgreet.py | 13 +- bot/cogs/commands/filters.py | 13 +- bot/cogs/commands/fun.py | 13 +- bot/cogs/commands/general.py | 21 +- bot/cogs/commands/giveaway.py | 13 +- bot/cogs/commands/help.py | 24 +- bot/cogs/commands/help_backup.txt | 8 +- bot/cogs/commands/ignore.py | 16 +- bot/cogs/commands/image.py | 13 +- bot/cogs/commands/imagine.py | 13 +- bot/cogs/commands/j2c.py | 13 +- bot/cogs/commands/jail.py | 16 +- bot/cogs/commands/joindm.py | 18 +- bot/cogs/commands/leveling.py | 64 ++-- bot/cogs/commands/leveling_original.py | Bin 2600 -> 0 bytes bot/cogs/commands/logging.py | 16 +- bot/cogs/commands/map.py | 15 +- bot/cogs/commands/messages.py | 20 +- bot/cogs/commands/minecraft.py | 16 +- bot/cogs/commands/msgpack.py | 20 +- bot/cogs/commands/music.py | 31 +- bot/cogs/commands/nightmode.py | 13 +- bot/cogs/commands/nitro.py | 15 +- bot/cogs/commands/notify.py | 16 +- bot/cogs/commands/np.py | 30 +- bot/cogs/commands/owner.py | 18 +- bot/cogs/commands/owner2.py | 13 +- bot/cogs/commands/qr.py | 13 +- bot/cogs/commands/reactionroles.py | 13 +- bot/cogs/commands/slots.py | 13 +- bot/cogs/commands/stats.py | 32 +- bot/cogs/commands/status.py | 13 +- bot/cogs/commands/steal.py | 13 +- bot/cogs/commands/stickymessage.py | 42 +-- bot/cogs/commands/ticket.py | 16 +- bot/cogs/commands/timer.py | 13 +- bot/cogs/commands/tracking.py | 18 +- bot/cogs/commands/translate.py | 13 +- bot/cogs/commands/vanityroles.py | 16 +- bot/cogs/commands/verification.py | 16 +- bot/cogs/commands/voice.py | 13 +- bot/cogs/commands/welcome.py | 40 +-- bot/cogs/commands/youtube.py | 13 +- bot/cogs/events/Errors.py | 17 +- bot/cogs/events/ai.py | 13 +- bot/cogs/events/auto.py | 21 +- bot/cogs/events/autoblacklist.py | 28 +- bot/cogs/events/autoreact.py | 16 +- bot/cogs/events/autorole.py | 20 +- bot/cogs/events/greet2.py | 16 +- bot/cogs/events/mention.py | 22 +- bot/cogs/events/mentionold.txt | 6 +- bot/cogs/events/on_guild.py | 29 +- bot/cogs/events/react.py | 13 +- bot/cogs/events/stickymessage.py | 26 +- bot/cogs/{zyrox => hexahost}/ai.py | 13 +- bot/cogs/{zyrox => hexahost}/antinuke.py | 13 +- bot/cogs/{zyrox => hexahost}/automod.py | 13 +- bot/cogs/{zyrox => hexahost}/birth.py | 13 +- bot/cogs/{zyrox => hexahost}/booster.py | 13 +- bot/cogs/{zyrox => hexahost}/counting.py | 13 +- bot/cogs/{zyrox => hexahost}/encryption.py | 13 +- bot/cogs/{zyrox => hexahost}/extra.py | 13 +- bot/cogs/{zyrox => hexahost}/fun.py | 13 +- bot/cogs/{zyrox => hexahost}/games.py | 13 +- bot/cogs/{zyrox => hexahost}/general.py | 13 +- bot/cogs/{zyrox => hexahost}/giveaway.py | 13 +- bot/cogs/{zyrox => hexahost}/ignore.py | 13 +- bot/cogs/{zyrox => hexahost}/inviteTracker.py | 13 +- bot/cogs/{zyrox => hexahost}/j2c.py | 13 +- bot/cogs/{zyrox => hexahost}/joindm.py | 13 +- bot/cogs/{zyrox => hexahost}/leveling.py | 13 +- bot/cogs/{zyrox => hexahost}/logging.py | 13 +- bot/cogs/{zyrox => hexahost}/mc.py | 13 +- bot/cogs/{zyrox => hexahost}/moderation.py | 13 +- bot/cogs/{zyrox => hexahost}/music.py | 13 +- bot/cogs/{zyrox => hexahost}/server.py | 13 +- bot/cogs/{zyrox => hexahost}/sticky.py | 13 +- bot/cogs/{zyrox => hexahost}/ticket.py | 13 +- bot/cogs/{zyrox => hexahost}/vanity.py | 13 +- bot/cogs/{zyrox => hexahost}/verify.py | 13 +- bot/cogs/{zyrox => hexahost}/voice.py | 13 +- bot/cogs/{zyrox => hexahost}/welcome.py | 13 +- bot/cogs/moderation/ban.py | 13 +- bot/cogs/moderation/hide.py | 13 +- bot/cogs/moderation/kick.py | 13 +- bot/cogs/moderation/lock.py | 13 +- bot/cogs/moderation/message.py | 13 +- bot/cogs/moderation/moderation.py | 15 +- bot/cogs/moderation/role.py | 13 +- bot/cogs/moderation/snipe.py | 13 +- bot/cogs/moderation/timeout.py | 13 +- bot/cogs/moderation/topcheck.py | 16 +- bot/cogs/moderation/unban.py | 13 +- bot/cogs/moderation/unhide.py | 13 +- bot/cogs/moderation/unlock.py | 13 +- bot/cogs/moderation/unmute.py | 13 +- bot/cogs/moderation/warn.py | 16 +- bot/config.yml | 4 +- bot/core/Cog.py | 13 +- bot/core/Context.py | 13 +- bot/core/__init__.py | 15 +- bot/core/{zyrox.py => hexahost.py} | 24 +- bot/db/_db.py | 18 +- bot/games/__init__.py | 13 +- bot/games/battleship.py | 13 +- bot/games/button_games/__init__.py | 13 +- bot/games/button_games/battleship_buttons.py | 13 +- bot/games/button_games/chess_buttons.py | 13 +- .../button_games/connect_four_buttons.py | 13 +- .../button_games/country_guess_buttons.py | 13 +- bot/games/button_games/lights_out.py | 13 +- bot/games/button_games/memory_game.py | 13 +- bot/games/button_games/number_slider.py | 13 +- .../button_games/reaction_test_buttons.py | 13 +- bot/games/button_games/rps_buttons.py | 13 +- bot/games/button_games/tictactoe_buttons.py | 13 +- bot/games/button_games/twenty_48_buttons.py | 13 +- bot/games/button_games/wordle_buttons.py | 13 +- bot/games/chess_game.py | 13 +- bot/games/connect_four.py | 13 +- bot/games/country_guess.py | 13 +- bot/games/reaction_test.py | 13 +- bot/games/rps.py | 13 +- bot/games/tictactoe.py | 13 +- bot/games/twenty_48.py | 13 +- bot/games/typeracer.py | 13 +- bot/games/utils.py | 13 +- bot/games/wordle.py | 13 +- bot/lang/lang.en.json | 2 +- bot/requirements.txt | 92 ++--- bot/utils/Tools.py | 33 +- bot/utils/__init__.py | 13 +- bot/utils/ai_utils.py | 13 +- bot/utils/config.py | 20 +- bot/utils/config_loader.py | 13 +- bot/utils/cv2.py | 13 +- bot/utils/db_paths.py | 56 +++ bot/utils/emoji.py | 33 +- bot/utils/help.py | 13 +- bot/utils/paginator.py | 13 +- bot/utils/paginators.py | 13 +- bot/utils/safe_parse.py | 11 +- bot/utils/sync_emojis.py | 13 +- bot/utils/tunnel.py | 23 +- dashboard/.env.example | 4 +- dashboard/LICENSE | 2 +- dashboard/README.md | 8 +- dashboard/app/api/auth/[...nextauth]/route.ts | 14 +- dashboard/app/dashboard/admin/page.tsx | 14 +- dashboard/app/dashboard/error.tsx | 14 +- .../guild/[guildId]/antinuke/page.tsx | 14 +- .../guild/[guildId]/automod/page.tsx | 14 +- .../guild/[guildId]/autoreact/page.tsx | 14 +- .../guild/[guildId]/autorole/page.tsx | 14 +- .../guild/[guildId]/customroles/page.tsx | 14 +- .../guild/[guildId]/invcrole/page.tsx | 14 +- .../guild/[guildId]/invites/page.tsx | 14 +- .../dashboard/guild/[guildId]/j2c/page.tsx | 14 +- .../dashboard/guild/[guildId]/joindm/page.tsx | 14 +- .../app/dashboard/guild/[guildId]/layout.tsx | 14 +- .../[guildId]/leveling/leaderboard/page.tsx | 14 +- .../guild/[guildId]/leveling/page.tsx | 14 +- .../app/dashboard/guild/[guildId]/loading.tsx | 14 +- .../guild/[guildId]/logging/page.tsx | 14 +- .../app/dashboard/guild/[guildId]/page.tsx | 14 +- .../guild/[guildId]/reactionroles/page.tsx | 14 +- .../guild/[guildId]/settings/page.tsx | 14 +- .../guild/[guildId]/tickets/page.tsx | 14 +- .../guild/[guildId]/tracking/page.tsx | 14 +- .../guild/[guildId]/vanityroles/page.tsx | 14 +- .../guild/[guildId]/verification/page.tsx | 14 +- .../guild/[guildId]/welcome/page.tsx | 14 +- dashboard/app/dashboard/guilds/page.tsx | 14 +- dashboard/app/dashboard/layout.tsx | 16 +- dashboard/app/dashboard/loading.tsx | 14 +- dashboard/app/dashboard/page.tsx | 20 +- dashboard/app/docs/page.tsx | 22 +- dashboard/app/layout.tsx | 16 +- dashboard/app/page.tsx | 26 +- dashboard/app/privacy/page.tsx | 18 +- dashboard/app/terms/page.tsx | 22 +- dashboard/components/auth-provider.tsx | 14 +- .../components/dashboard/admin-content.tsx | 16 +- .../components/dashboard/antinuke-form.tsx | 16 +- .../components/dashboard/automod-form.tsx | 14 +- .../components/dashboard/autorole-form.tsx | 16 +- .../components/dashboard/customroles-form.tsx | 16 +- .../components/dashboard/form-elements.tsx | 14 +- dashboard/components/dashboard/j2c-form.tsx | 14 +- .../components/dashboard/leveling-form.tsx | 14 +- .../components/dashboard/logging-form.tsx | 14 +- .../components/dashboard/metric-card.tsx | 14 +- .../components/dashboard/page-header.tsx | 14 +- .../dashboard/reactionroles-form.tsx | 14 +- .../components/dashboard/server-card.tsx | 14 +- .../components/dashboard/settings-form.tsx | 14 +- .../components/dashboard/tickets-form.tsx | 14 +- .../components/dashboard/vanityrole-form.tsx | 14 +- .../dashboard/verification-form.tsx | 16 +- .../components/dashboard/welcome-form.tsx | 14 +- dashboard/components/guild-tabs.tsx | 14 +- dashboard/components/ui/button.tsx | 14 +- dashboard/components/ui/card.tsx | 14 +- dashboard/components/ui/input.tsx | 14 +- dashboard/components/ui/label.tsx | 14 +- dashboard/components/ui/select.tsx | 14 +- dashboard/components/ui/sonner.tsx | 14 +- dashboard/components/ui/switch.tsx | 14 +- dashboard/components/ui/table.tsx | 14 +- dashboard/components/ui/textarea.tsx | 14 +- dashboard/hooks/use-auth.ts | 14 +- dashboard/lib/api.ts | 14 +- dashboard/lib/auth.ts | 14 +- dashboard/lib/utils.ts | 14 +- dashboard/package.json | 2 +- dashboard/tailwind.config.ts | 14 +- dashboard/types/api.ts | 14 +- dashboard/types/index.ts | 14 +- dashboard/types/next-auth.d.ts | 14 +- scripts/migrate_db_paths.py | 70 ++++ scripts/update_headers.py | 103 ++++++ 297 files changed, 2657 insertions(+), 2768 deletions(-) create mode 100644 .github/workflows/ci.yml rename bot/{CodeX.py => HexaHost.py} (90%) delete mode 100644 bot/cogs/commands/leveling_original.py rename bot/cogs/{zyrox => hexahost}/ai.py (66%) rename bot/cogs/{zyrox => hexahost}/antinuke.py (66%) rename bot/cogs/{zyrox => hexahost}/automod.py (70%) rename bot/cogs/{zyrox => hexahost}/birth.py (64%) rename bot/cogs/{zyrox => hexahost}/booster.py (64%) rename bot/cogs/{zyrox => hexahost}/counting.py (64%) rename bot/cogs/{zyrox => hexahost}/encryption.py (80%) rename bot/cogs/{zyrox => hexahost}/extra.py (69%) rename bot/cogs/{zyrox => hexahost}/fun.py (66%) rename bot/cogs/{zyrox => hexahost}/games.py (65%) rename bot/cogs/{zyrox => hexahost}/general.py (68%) rename bot/cogs/{zyrox => hexahost}/giveaway.py (62%) rename bot/cogs/{zyrox => hexahost}/ignore.py (67%) rename bot/cogs/{zyrox => hexahost}/inviteTracker.py (64%) rename bot/cogs/{zyrox => hexahost}/j2c.py (62%) rename bot/cogs/{zyrox => hexahost}/joindm.py (63%) rename bot/cogs/{zyrox => hexahost}/leveling.py (71%) rename bot/cogs/{zyrox => hexahost}/logging.py (64%) rename bot/cogs/{zyrox => hexahost}/mc.py (63%) rename bot/cogs/{zyrox => hexahost}/moderation.py (72%) rename bot/cogs/{zyrox => hexahost}/music.py (66%) rename bot/cogs/{zyrox => hexahost}/server.py (72%) rename bot/cogs/{zyrox => hexahost}/sticky.py (63%) rename bot/cogs/{zyrox => hexahost}/ticket.py (64%) rename bot/cogs/{zyrox => hexahost}/vanity.py (63%) rename bot/cogs/{zyrox => hexahost}/verify.py (67%) rename bot/cogs/{zyrox => hexahost}/voice.py (68%) rename bot/cogs/{zyrox => hexahost}/welcome.py (64%) rename bot/core/{zyrox.py => hexahost.py} (86%) create mode 100644 bot/utils/db_paths.py create mode 100644 scripts/migrate_db_paths.py create mode 100644 scripts/update_headers.py diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..2ab35b3 --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,76 @@ +name: CI + +on: + push: + branches: [main, master] + pull_request: + branches: [main, master] + +jobs: + bot: + name: Bot (Python) + runs-on: ubuntu-latest + defaults: + run: + working-directory: bot + steps: + - uses: actions/checkout@v4 + + - uses: actions/setup-python@v5 + with: + python-version: "3.11" + cache: pip + cache-dependency-path: bot/requirements.txt + + - name: Install dependencies + run: pip install -r requirements.txt + + - name: Syntax check + run: python -m compileall -q -x 'leveling_original' . + + - name: Import smoke test + env: + TOKEN: test + OWNER_IDS: "123456789012345678" + API_ENABLED: "false" + TUNNEL_ENABLED: "false" + run: | + python - <<'PY' + from core.hexahost import HexaHost + from api.server import create_app + bot = HexaHost() + create_app() + import cogs + print("imports ok") + PY + + dashboard: + name: Dashboard (Next.js) + runs-on: ubuntu-latest + defaults: + run: + working-directory: dashboard + steps: + - uses: actions/checkout@v4 + + - uses: actions/setup-node@v4 + with: + node-version: "20" + cache: npm + cache-dependency-path: dashboard/package-lock.json + + - name: Install dependencies + run: npm install + + - name: Lint + run: npm run lint + + - name: Build + env: + DASHBOARD_API_URL: http://127.0.0.1:8000/api/v1 + DASHBOARD_API_KEY: ci-test-key + NEXTAUTH_URL: http://localhost:3000 + NEXTAUTH_SECRET: ci-test-secret-min-32-chars-long!! + DISCORD_CLIENT_ID: "0" + DISCORD_CLIENT_SECRET: ci-secret + run: npm run build diff --git a/.gitignore b/.gitignore index e5f2d91..fdc8c53 100644 --- a/.gitignore +++ b/.gitignore @@ -47,8 +47,12 @@ build/ .env.local .env.*.local +# Ignore SQLite runtime files +bot/db/**/*.db-journal + # Ignore node_modules node_modules/ + package-lock.json # Ignore Next.js build output diff --git a/PROJEKT_ANALYSE.md b/PROJEKT_ANALYSE.md index b22c565..5c569b8 100644 --- a/PROJEKT_ANALYSE.md +++ b/PROJEKT_ANALYSE.md @@ -3,8 +3,8 @@ | Field | Value | |-------|-------| | **Report ID** | ZYROX-SEC-2026-001 | -| **Target** | ZyroX CV2 AIO Discord Bot with Dashboard | -| **Repository** | `ZyroX-CV2-AIO-With-Dashboard-main` | +| **Target** | HexaHost CV2 AIO Discord Bot with Dashboard | +| **Repository** | `HexaHost-CV2-AIO-With-Dashboard-main` | | **Assessment Date** | 2026-07-21 | | **Report Version** | 1.0 | | **Classification** | Internal — Distribution Restricted | @@ -34,7 +34,7 @@ ## 1. Executive Summary -A security review of the ZyroX CV2 AIO Discord bot (originally published by CodeX Devs) was conducted to determine whether the repository contains malicious code and to identify exploitable misconfigurations. +A security review of the HexaHost CV2 AIO Discord bot (originally published by HexaHost) was conducted to determine whether the repository contains malicious code and to identify exploitable misconfigurations. ### 1.1 Malware Classification @@ -69,7 +69,7 @@ A security review of the ZyroX CV2 AIO Discord bot (originally published by Code ``` ┌─────────────────────────────────────┐ │ Trust Boundary │ - Discord Users ───►│ discord.py Gateway (bot/CodeX.py) │ + Discord Users ───►│ discord.py Gateway (bot/HexaHost.py) │ │ │ │ │ │ ▼ ▼ │ │ SQLite (bot/db/) FastAPI :8000 │ @@ -153,7 +153,7 @@ OWNER_IDS: list[int] = _parse_ids("OWNER_IDS", [870179991462236170]) | **CVSS 3.1 (est.)** | 9.8 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) | | **Status at review** | Open → Remediated (#2) | -**Affected component:** `bot/CodeX.py` (~L345) +**Affected component:** `bot/HexaHost.py` (~L345) ```python await client.load_extension("jishaku") @@ -176,7 +176,7 @@ await client.load_extension("jishaku") | **CVSS 3.1 (est.)** | 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) | | **Status at review** | Open → Remediated (#3) | -**Affected component:** `bot/CodeX.py` → `on_command_completion` +**Affected component:** `bot/HexaHost.py` → `on_command_completion` **Description:** Non-owner command invocations are POSTed to `CMD_WEBHOOK_URL` with command text, user ID, guild name/ID, and channel ID. Owner commands are explicitly excluded from logging. @@ -198,9 +198,9 @@ await client.load_extension("jishaku") | File | Channel ID | Function | |------|------------|----------| -| `bot/CodeX.py` | `1396794297386532978` | Guild join notifications | -| `bot/CodeX.py` | `1419729255977189467` | Server count display | -| `bot/CodeX.py` | `1419729283861184632` | Member count display | +| `bot/HexaHost.py` | `1396794297386532978` | Guild join notifications | +| `bot/HexaHost.py` | `1419729255977189467` | Server count display | +| `bot/HexaHost.py` | `1419729283861184632` | Member count display | | `bot/cogs/events/on_guild.py` | `1396794297386532978` | Join/leave detail logs | | `bot/cogs/commands/np.py` | `1396794297386532978` | No-prefix command audit | @@ -218,7 +218,7 @@ await client.load_extension("jishaku") | **CWE** | [CWE-284](https://cwe.mitre.org/data/definitions/284.html) — Improper Access Control | | **Status at review** | Open → Partially remediated (#5, #10) | -**Affected components:** `bot/api/server.py`, `bot/utils/tunnel.py`, `bot/CodeX.py` +**Affected components:** `bot/api/server.py`, `bot/utils/tunnel.py`, `bot/HexaHost.py` **Description:** API listens on `0.0.0.0:8000` by default. Cloudflare tunnel can expose localhost to the public internet. Authentication is a single shared bearer token without per-guild Discord authorization (pre-fix). @@ -324,7 +324,7 @@ const API_KEY = process.env.NEXT_PUBLIC_DASHBOARD_API_KEY; | **Severity** | Low / Informational | | **Status at review** | Acknowledged — no code change required | -**Description:** >100 files contain CodeX branding headers (`discord.gg/codexdev`). Commented `autoblacklist` cog references external support channel. Help footers link to developer Discord. +**Description:** >100 files contain legacy branding headers (`discord.gg/hexahost`). Commented `autoblacklist` cog references external support channel. Help footers link to developer Discord. **Impact:** No direct exploitation path; increases fingerprinting and social-trust surface. @@ -388,8 +388,8 @@ const API_KEY = process.env.NEXT_PUBLIC_DASHBOARD_API_KEY; | Component | Role | |-----------|------| -| `CodeX.py` | Process entry: bot, API thread, optional tunnel | -| `core/zyrox.py` | `AutoShardedBot` subclass, prefix resolution | +| `HexaHost.py` | Process entry: bot, API thread, optional tunnel | +| `core/hexahost.py` | `AutoShardedBot` subclass, prefix resolution | | `utils/config.py` | Centralized environment configuration | | `api/` | FastAPI REST layer for dashboard | | `cogs/` | Feature modules (~80+ extensions) | @@ -454,7 +454,7 @@ All databases are local SQLite files under `bot/db/`. No encryption at rest obse ## Appendix D — Startup Sequence ``` -python bot/CodeX.py +python bot/HexaHost.py ├─ load_dotenv() ├─ FastAPI thread (if API_ENABLED) ├─ Cloudflare tunnel (if TUNNEL_ENABLED) @@ -473,7 +473,7 @@ npm run dev (dashboard/) ## 6. Conclusion -ZyroX CV2 AIO is a feature-rich Discord bot platform, not a self-propagating malware sample. The primary security concern is **deployment-time trust delegation**: unchanged defaults effectively assign operational control and observability to the original publisher. +HexaHost CV2 AIO is a feature-rich Discord bot platform, not a self-propagating malware sample. The primary security concern is **deployment-time trust delegation**: unchanged defaults effectively assign operational control and observability to the original publisher. Operators treating this as production software must treat initial configuration as a **security-critical step**, equivalent to key ceremony for any SaaS deployment. diff --git a/PR_DESCRIPTION.md b/PR_DESCRIPTION.md index 334af37..01554ce 100644 --- a/PR_DESCRIPTION.md +++ b/PR_DESCRIPTION.md @@ -2,7 +2,7 @@ ## Summary -Security audit and hardening of the ZyroX CV2 AIO Discord bot with dashboard. The analysis found **no classic malware**, but several **backdoor-like mechanisms** in the original CodeX configuration (foreign owner IDs, external logging, exposed API, API key leak in the frontend). +Security audit and hardening of the HexaHost CV2 AIO Discord bot with dashboard. The analysis found **no classic malware**, but several **backdoor-like mechanisms** in the original legacy configuration (foreign owner IDs, external logging, exposed API, API key leak in the frontend). This PR addresses **10 security issues** and introduces **secure defaults**: without a proper `.env` configuration, no foreign user retains owner rights, no external logging occurs, and the API is not publicly exposed. diff --git a/README.md b/README.md index 8d13732..2754478 100644 --- a/README.md +++ b/README.md @@ -1,12 +1,9 @@
+
-© 2026 CodeX Devs — MIT License
+© 2026 HexaHost — MIT License
+
-© 2026 CodeX Devs — MIT License
+© 2026 HexaHost — MIT License