mirror of
https://github.com/NoFxAiOS/nofx.git
synced 2026-07-02 18:41:01 +08:00
GetAnyEnabled() searched across all users in DB — if user B has an enabled model, bot could use their API key while acting as user A. Now uses GetDefault(botUserID) which only looks up the bound user's enabled model, matching the same user scope as all API calls.