SLH Control Center

Real-time ecosystem monitoring · Session history · Version control · Security audit

LIVE · Auto-refresh 30s ·
Overview
Session History
Versions
Bots (25)
Pages (49)
API
Security
Tasks
API Status
...
Total Users
...
API Endpoints
...
production
HTML Pages
49
GitHub Pages
Bots Running
25
Docker Compose
Genesis Raised
...
Audit Chain
...
Security Issues
3
P0: 1 fixed, 2 remaining

Live Activity Feed Real-time

Loading...

System Coverage

shared.js loaded
91%
Theme switcher
42%
i18n translations
37%
Analytics tracking
100%
AI Assistant
42%
OG Meta tags
65%
Security audit
30%

System Architecture

Users (16) slh-nft.com (49 pages) Railway API
Telegram Users 25 Bots (Docker) Railway API
Railway API PostgreSQL + Redis + BSC Chain

Session Timeline 8 Sessions

API Repository (slh-api)

Website Repository

Telegram Bots — 25 Services Loading...

BotContainerStatusCategoryNotes

Website Pages — 49 HTML

PageStatusNavThemei18nAnalyticsAI

API Endpoints

Click "Test All" to check all endpoints

Security Audit 5 Issues

FIXED
Admin passwords in public HTML
Session 12: Removed ADMIN_PASSWORDS array, deleted admin-test.html bypass, multi-admin system with hashed passwords deployed
P0
Railway env vars missing
JWT_SECRET is empty, ADMIN_API_KEYS using defaults — auth is broken
P1
31 bot tokens exposed
All bot tokens were pasted in chat history. Need rotation via @BotFather
P1
Unprotected API endpoints
/api/tokenomics/burn, /api/tokenomics/reserves/add — no auth required for destructive operations
P2
Wallet address mismatch
Two different addresses in code: 0xd061... (genesis) vs 0xD061... (MetaMask). Need confirmation which is correct
P1
User data exposed without auth
GET /api/user/{telegram_id} returns full profile + balances with NO authentication. Anyone with a Telegram ID can see balances.
P2
Swagger /docs publicly accessible
Full OpenAPI spec with all 137 routes is browsable by anyone. Consider restricting in production.

P0 — Critical

P1 — High Impact

P2 — Improvements