mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
klopez4212andnpub13fn4ahfnvaa2qwylvegdgeajqs0mph6v4qsw4jcqnw4mjh3hzh2quuucm5
bf8ca927ee
Add expires_after: 60 (seconds) to the OpenAI Realtime client-secret request payload. This limits the reuse window of minted secrets — a client must establish its WebRTC connection within 60s, and cannot reuse the secret to open additional sessions after that. Without this, the default 600s TTL allowed a compromised or malicious client to bypass the per-pubkey rate limiter by reusing a single minted secret for many concurrent sessions.