- Pass ML-Worker key via env/stdin instead of argv to reduce exposure in process listings/logs.
- Add a hard timeout to the ML-Worker subprocess call and convert timeouts into DecryptionFailed errors.
- Make ticket bytes decoding defensive: try UTF-8, fall back to ASCII (base64), otherwise raise a descriptive ValueError.
6c83790834