mirror of
https://github.com/luxfi/aml.git
synced 2026-09-24 00:25:20 +00:00
zeekayandHanzo Dev
992f784038
Driving the real router through every registered path — the test that caught the unregistered /v1/aml/config — also showed which routes answer a caller holding no credential at all. Two did. The rule list is the map of what this institution's monitoring looks for and what it does not, which is precisely what somebody structuring a payment around it wants; it is the deployment's catalog rather than a tenant's data, but that is an argument about scoping, not about publishing it. Sanctions search runs a fuzzy match over every designation in the set, so serving it unauthenticated hands out that work for free, and the name being searched is somebody's name. Two routes now answer without a tenant, and only two: /v1/aml/config, whose whole job is to name the issuer a token comes from, and /v1/aml/health, which a probe reads on a pod IP that names no brand. LLM.md says so, and lists the two routes it had never mentioned. Co-authored-by: Hanzo Dev <[email protected]>