- Add 5 screenshots showcasing main features
- Include dashboard, rooms, leaderboard, rewards, and achievements views
- Organize in collapsible section for better README readability
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Add recommended deployment option using pre-built mellowfox/tidyquest:latest image
- Keep build-from-source option for development/customization
- Update "Updating" section with separate instructions for both methods
- Simplifies installation for end users who don't need to build
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Security fix for CodeQL alert:
- Add regex validation for Telegram bot token format
- Token must match pattern: \d+:[A-Za-z0-9_-]+
- Prevents Server-Side Request Forgery (SSRF) attacks
- Rejects malformed tokens that could target internal services
CodeQL Rule: js/request-forgery
Severity: High
File: server/src/utils/notifications.ts:95
While TidyQuest is self-hosted and the admin is trusted, this
defense-in-depth measure prevents accidental misuse and follows
security best practices.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
