Z. Cliffe Schreuders cda71cf6f3 SECURITY: Enforce server-side validation for all PIN/password attempts ...

Critical security fix: PIN and password minigames were falling back to
client-side validation when the correct answer was available. This allowed
players to bypass security by inspecting client-side code.

Changes:
- PIN minigame: ALWAYS use server-side validation, never client-side
- Password minigame: ALWAYS use server-side validation, never client-side
- If API client is unavailable, fail securely by rejecting the attempt
- Removed backwards compatibility code that allowed client-side validation

Security principle: Never trust the client for authentication/authorization.
All PIN and password validation must go through the server.

2025-11-22 00:46:56 +00:00

..

break_escape

SECURITY: Enforce server-side validation for all PIN/password attempts

2025-11-22 00:46:56 +00:00