mirror of
https://github.com/block/buzz.git
synced 2026-11-09 02:41:57 +00:00
Lease sizing assumes the endpoint grant needs no JSON escaping. Publication accepted any string up to the endpoint limit, so a grant JSON escapes could pass sizing and then exceed the plaintext limit. Accept only the gateway's `<key id>.<base64url>` alphabet so sizing and publication agree. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tom Brow <tomb@block.xyz>