From eca3dd39a08962a1be7d3d7a15dc30434581c9b0 Mon Sep 17 00:00:00 2001
From: anupamme <mediratta@gmail.com>
Date: Wed, 29 Jul 2026 01:15:08 +0000
Subject: [PATCH] fix: V-001 security vulnerability

Automated security fix generated by OrbisAI Security
---
 src/everything/transports/sse.ts | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/everything/transports/sse.ts b/src/everything/transports/sse.ts
index 2406db7cfa..db434e9daf 100644
--- a/src/everything/transports/sse.ts
+++ b/src/everything/transports/sse.ts
@@ -16,6 +16,15 @@ app.use(
   })
 );
 
+// Optional token-based authentication middleware
+const API_KEY = process.env.API_KEY;
+app.use((req, res, next) => {
+  if (!API_KEY) { next(); return; }
+  const auth = req.headers.authorization;
+  if (auth === `Bearer ${API_KEY}`) { next(); return; }
+  res.status(401).json({ error: "Unauthorized" });
+});
+
 // Map sessionId to transport for each client
 const transports: Map<string, SSEServerTransport> = new Map<
   string,