Block a user
Do not ship selectable no-op database/log delivery target types
Keep the SSRF-safe Transport in clientForConfig when a per-target timeout is set
Validate Slack target URLs at creation time (SSRF parity with HTTP targets)
1.0/mvp
1.0 readiness — re-audit (2026-08-07)
Re-audited origin/main against the March security audit above. The five blockers and the should-fix items you asked to fix are all done and verified in…
Optional inbound webhook HMAC signature verification
Add inactivity-based session timeout
Add an admin password change flow in the web UI
Rate-limit the public webhook receiver endpoint
Enforce per-webhook event retention (RetentionDays reaper)
Reconcile HTTP WriteTimeout with the request middleware timeout
Set Cache-Control: no-store on authenticated pages
Wrap the /user/{username} route in RequireAuth middleware
Fix remaining gosec lint findings on main
internal/resolver tests query live nameservers and fail nondeterministically
TestRouteWatchLiveFeed is network-flaky; make
make check deterministic
Add missing standard config files: .gitignore, .dockerignore, .editorconfig, .golangci.yml
The dotfiles portion of this issue is complete and pushed, but I can't open the PR: clawbot is not a collaborator on sneak/bsdaily, so PR creation returns user must be a collaborator. (It…
Add .editorconfig (refs #59)
Review:
Independent adversarial review (reviewer separate from the author):
Review: sneak/vaultik PR issue-59-editorconfig (a8a424d)
1. Scope — PASS Diff adds exactly one file, `.editorconf…
Add .editorconfig (refs #59)
Add .editorconfig (closes #27)
Review of PR #28 (sneak/secret,
Independent adversarial review (reviewer separate from the author):
Review of PR #28 (sneak/secret, issue-27-editorconfig, 8ccd2bf)
1. Scope — PASS. Diff adds exactly one file,…
frontend: gate the Docker build on make check (closes #11)