[ralyodio]

Adds sh1pt Actions Fleet packs: coinpay-invoice (/coinpay invoice $100 usd in SOL, /coinpay connect, /coinpay help).

Secrets COINPAY_API_KEY / COINPAY_BUSINESS_ID are set on the repo.

🤖 Generated with Claude Code

[github-actions]

ThreatCrush Security Scan

16 finding(s)

MEDIUM: 6 | LOW: 10

Severity	Rule	Location
MEDIUM	js-open-redirect	src/lib/components/Header.svelte:76
MEDIUM	js-open-redirect	src/lib/components/Header.svelte:86
MEDIUM	js-open-redirect	src/lib/components/WalletConnect.svelte:148
MEDIUM	js-jwt-decode-without-verify	src/lib/server/jwt-auth-secure.js:362
MEDIUM	js-jwt-decode-without-verify	src/lib/server/jwt-auth-secure.js:377
MEDIUM	js-open-redirect	src/lib/utils/notifications.js:82
LOW	secret-generic-credential	tests/client-auth.test.js:312
LOW	secret-generic-credential	tests/reveal-confirmation-fix.test.js:138
LOW	secret-generic-credential	tests/reveal-confirmation-fix.test.js:187
LOW	secret-generic-credential	tests/reveal-confirmation-fix.test.js:270
LOW	secret-generic-credential	tests/server-side-auth-api.test.js:177
LOW	secret-generic-credential	tests/server-side-auth-api.test.js:268
LOW	secret-generic-credential	tests/server-side-auth-api.test.js:376
LOW	secret-generic-credential	tests/server-side-auth-api.test.js:377
LOW	secret-jwt	tests/test-wallet-ambiguity-fix.js:7
LOW	secret-jwt	tests/wallet-address-ambiguity-fix.test.js:8

Snippets are redacted; ThreatCrush never prints matched credential material.