minimax-h3-video

The code has a meaningful credential-disclosure risk when resuming from an untrusted or modified state file: arbitrary status_url/response_url values can receive the Fal Authorization header. Restrict these URLs to the expected Fal origin (and validate their paths) before calling api(). The video download URL should also be constrained if responses are not fully trusted. No clear malicious behavior is evident.