GHSA-v828-m3pf-vq9q

## Summary

Unauthenticated payment webhook endpoints could read and log the entire request body before validating the webhook signature. When a payment webhook was enabled, an unauthenticated attacker could send oversized requests to public callback endpoints and force excessive memory use and log growth before the request was rejected.

Affected public endpoints included:

- `POST /api/stripe/webhook` - `POST /api/creem/webhook` - `POST /api/waffo/webhook`

This issue did not allow forging successful payments, because signature validation still guarded the payment processing logic. The vulnerable behavior was the expensive unauthenticated request processing that occurred before signature validation.

## Impact

A remote unauthenticated attacker could cause denial of service through memory pressure, container OOM/restarts, or disk consumption from full-body logging. The impact is availability-only and is rated High.

## Affected versions

Versions before `v1.0.0-rc.11` are affected. The earlier affected range of `<= v1.0.0-rc.7` was incomplete; the anonymous request body limit was introduced later and first appears in `v1.0.0-rc.11`.

## Patches

This issue is fixed in `v1.0.0-rc.11`. The fix adds `middleware.AnonymousRequestBodyLimit()` and applies it to unauthenticated POST routes, including the payment webhook callbacks. The default limit is controlled by `ANONYMOUS_REQUEST_BODY_LIMIT_KB` and defaults to 512 KiB.

## Workarounds

If upgrading immediately is not possible, operators should disable unused payment webhooks, enforce request body limits at a reverse proxy or load balancer, and ensure application and container logs have rotation and quotas. These mitigations reduce exposure but do not replace upgrading.

## References

- Fixed by commit `d2f7f9ee3adf3ef66798783a60d7bc712451c85c`. - Relevant code paths: `router/api-router.go`, `middleware/request_body_limit.go`, `controller/topup_stripe.go`, `controller/topup_creem.go`, and `controller/topup_waffo.go`.