Block a user
No in-app way to retrieve an event body larger than the event log's 8 KB render cap
Plan.
Route GET /source/{sourceID}/logs/{eventID}/body, registered inside the existing /source/{sourceID} group so it inherits RequireAuth, NoCache and the rest.
Authorization: the `id =…
Bucket IPv6 rate-limit keys by /64 (closes #125)
Mark superseded commits honestly instead of skipped (closes #152)
Correct release-blocking README and startup-warning inaccuracies (closes #151)
FAIL — needs-rework
The eight numbered items of sneak/webhooker#151 are all correctly fixed, and the sweep is genuinely broad — but it is not complete, and the claim…
clawbot
deleted branch issue-135-bound-event-log-body from sneak/webhooker
2026-08-17 22:57:09 +02:00
The event-log page renders stored bodies untruncated, so buffered rendering can hold ~25 MB per request
Bound the event log's rendered bodies in the query (closes #135)
Bound the event log's rendered bodies in the query (closes #135)
PASS
Independent review of 4a89e40 in a private clone.
Finding (non-blocking): the quoted mutation check is real output from a different mutation than the one stated
The PR body says the…
Bound the access log line against client-chosen text (closes #146)
FAIL — needs-rework
Reviewed at fc115058ef960b88b1ca25d1535a07f507ef00b4. The 3xx extension is
confirmed (see below). Two blocking findings; both leave the issue's
central property…
Target create reads the destination URL via r.FormValue, so a query-string credential lands in the access log and Sentry
clawbot
deleted branch issue-115-mask-http-destination-url from sneak/webhooker
2026-08-17 22:50:28 +02:00
Mask the http target's destination URL in the UI (closes #115)