Spaces:
Sleeping
Sleeping
Commit History
-
security: require a shared service key on /tts and /extract-resume
Both compute endpoints were reachable by anyone who knew the Space URL. require_service_key checks x-service-key with hmac.compare_digest and fails closed when SERVICE_API_KEY is unset. /health stays open for platform probes. SERVICE_API_KEY is set on this Space and the backend already sends it.97e667f
