websocket

No apparent malicious behavior or supply-chain attack is present. The code is intended as WebSocket security guidance, but it has notable security and correctness issues: bearer tokens in query strings, incomplete JWT claim-validation evidence, a connection-manager deadlock, potentially incorrect IP accounting, and permissive fallback dispatch for unknown actions. These issues should be fixed before production use.