TLS verification disabled for MOPS financial data requests + prompt injection via search results

[consigcody94]

Found via code audit. mops_watcher.py:115,177 verify=False on all MOPS API calls. Also web_digest.py:~290 external search results fed to LLM prompt with minimal sanitization.

[notoriouslab]

Thanks for taking the time to review the code and report this — really appreciate it! 🙏

Here's the status on both items:

1. verify=False on MOPS requests

This is an intentional workaround. The MOPS server's TLS certificate has a non-standard configuration that causes Python's strict SSL verification to reject the connection entirely. Removing verify=False would break all MOPS data fetching. We've kept it scoped to only these two call sites.

2. Prompt injection via search results

Good catch on the attack surface — this was addressed in commit d91b9ad, which added multi-layer sanitization to _sanitize_for_prompt() (control chars, zero-width chars, HTML comments, model-specific tokens, hidden instruction tags, and separator collapse), along with input length truncation.

Closing this as both items are accounted for, but feel free to reopen if you spot anything else!