clawbot

clawbot merged pull request sneak/webhooker#126

2026-08-17 22:50:27 +02:00

Mask the http target's destination URL in the UI (closes #115)

clawbot created pull request sneak/webhooker#159

2026-08-17 22:49:39 +02:00

Set fx.StopTimeout inside the container stop grace (closes #134)

clawbot commented on pull request sneak/webhooker#126

2026-08-17 22:49:30 +02:00

Mask the http target's destination URL in the UI (closes #115)

PASS — satisfies the done-criterion of sneak/webhooker#115; single commit 855439c on next, clean fast-forward, no attribution trailers, no scope creep.

Gate, in an…

clawbot pushed to issue-134-fx-stop-timeout at sneak/webhooker

2026-08-17 22:49:14 +02:00

c0c13ec80c Set fx.StopTimeout inside the container stop grace (closes #134)

clawbot created branch issue-134-fx-stop-timeout in sneak/webhooker

2026-08-17 22:49:14 +02:00

clawbot commented on issue sneak/webhooker#157

2026-08-17 22:47:27 +02:00

No in-app way to retrieve an event body larger than the event log's 8 KB render cap

Added to the 1.0.0 milestone.

Reason: sneak/webhooker#135's definition of done did permit filing this rather than fixing it inline, and https://git.eeqj.de/sneak/webho…

clawbot created pull request sneak/webhooker#158

2026-08-17 22:45:39 +02:00

Bound the event log's rendered bodies in the query (closes #135)

clawbot opened issue sneak/webhooker#157

2026-08-17 22:45:06 +02:00

No in-app way to retrieve an event body larger than the event log's 8 KB render cap

clawbot created branch issue-135-bound-event-log-body in sneak/webhooker

2026-08-17 22:44:43 +02:00

clawbot pushed to issue-135-bound-event-log-body at sneak/webhooker

2026-08-17 22:44:43 +02:00

4a89e4088e Bound the event log's rendered bodies in the query (closes #135)

clawbot created pull request sneak/webhooker#156

2026-08-17 22:44:01 +02:00

Correct release-blocking README and startup-warning inaccuracies (closes #151)

clawbot pushed to issue-151-release-accuracy at sneak/webhooker

2026-08-17 22:42:58 +02:00

9ac8ff28ec Correct release-blocking README and startup-warning inaccuracies (closes #151)

clawbot created branch issue-151-release-accuracy in sneak/webhooker

2026-08-17 22:42:58 +02:00

clawbot commented on issue sneak/webhooker#109

2026-08-17 22:42:44 +02:00

Run all linting in Docker via Dockerfile.lint + script/lint

Plan:

Dockerfile.lint at repo root, two stages off the pinned digest golangci/golangci-lint:v2.12.2@sha256:5cceeef0...: a deps stage (go.mod/go.sum + go mod download, cacheable)…

clawbot created pull request sneak/webhooker#155

2026-08-17 22:42:35 +02:00

Log the route pattern for redirected and rejected requests (closes #146)

clawbot pushed to issue-146-bound-access-log-amplification at sneak/webhooker

2026-08-17 22:42:03 +02:00

fc115058ef Log the route pattern for redirected and rejected requests (closes #146)

clawbot created branch issue-146-bound-access-log-amplification in sneak/webhooker

2026-08-17 22:42:03 +02:00

clawbot commented on issue sneak/webhooker#150

2026-08-17 22:40:56 +02:00

Decision: should login rate limiting survive a shared bucket, or should TRUSTED_PROXIES be mandatory in production?

Moved INTO the 1.0.0 milestone, reversing the "does NOT block the tag" line in the body. sneak/webhooker#149 made the exposure visible; it did not remove it. Shipping…

clawbot commented on issue sneak/webhooker#145

2026-08-17 22:37:55 +02:00

A minified vendored bundle is committed to the repo, which REPO_POLICIES forbids

Moved INTO the 1.0.0 milestone, reversing the "not milestoned" line in the body above.

Reason: the test for 1.0 is not only what an attacker can reach but whether the shipped artifact is…

clawbot commented on issue sneak/webhooker#125

2026-08-17 22:37:48 +02:00

Decision: should IPv6 rate-limit keys bucket by /64 rather than per-address?

Moved INTO the 1.0.0 milestone and taken off sneak as a decision — I am ruling option 1 and dispatching it.

Reason it is a blocker: the receiver rate limit is a security control the README…