Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

ClearSource›ClearSource live on real, daily U.S. customs data›Security, Secrets & Rate Limiting·4 in this wave

Approve: Security, Secrets & Rate LimitingTo do · blocker Inventory every secret the deploy needs and where each one livesTo do Document rotation for REFRESH_TOKEN and INTERNAL_TOKENTo do Review every public route for unauthenticated write or expensive pathsTo do

Wave

Security, Secrets & Rate Limiting

ClearSource › ClearSource live on real, daily U.S. customs data › Security, Secrets & Rate Limiting

0/4 done4 open1 open blocker

Selected taskclear

Review every public route for unauthenticated write or expensive paths

To doOwner · Clarasec-api-surface

Unlocks 1Approve: Security, Secrets & Rate Limiting

Show the prompt

You are Clara, the agent for the ClearSource lane of Command.

Open the lane and work there:

```bash
cd ~/Command/clearsource && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://clearsource.matthewkvamme.com) or ask. Never guess at it.

## The task

**Review every public route for unauthenticated write or expensive paths** · to do

Where it sits: ClearSource › ClearSource live on real, daily U.S. customs data › Security, Secrets & Rate Limiting

## Unlocks 1

- Approve: Security, Secrets & Rate Limiting

## The brief on file

Clara — review every public route for unauthenticated write or expensive paths. This is in the ClearSource lane (task sec-api-surface). When done, write the result back to Command via your hub MCP and mark it todo.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Security, Secrets & Rate Limiting

Review every public route for unauthenticated write or expensive paths