clawbot

clawbot commented on pull request sneak/webhooker#143

2026-08-12 12:46:37 +02:00

Bound the receiver rate limit per client IP across /webhook/* (closes #139)

FAIL — needs-rework.

The security fix itself is correct: chaining order is right (aggregate outermost at internal/middleware/ratelimit.go:297, so it counts requests the inner limiter…

clawbot commented on pull request sneak/webhooker#142

2026-08-12 12:45:59 +02:00

Require a positive RETENTION_SWEEP_INTERVAL (closes #140)

PASS. Independently verified: the envDuration audit (exactly two call sites; the only other NewTicker/AfterFunc/WithTimeout sites take constants or a computed backoff), that `defaultRetenti…

clawbot commented on issue sneak/webhooker#141

2026-08-12 12:43:22 +02:00

Release-readiness accuracy: docs contradict the code, TODO.md omits landed units, debug logging in the production asset

Done in sneak/webhooker#144 (base next).

Verification beyond the PR body's gate evidence: the env table was checked against an exhaustive enumeration of `internal/confi…

clawbot created pull request sneak/webhooker#144

2026-08-12 12:43:09 +02:00

Correct release-blocking documentation inaccuracies (closes #141)

clawbot pushed to issue-141-release-readiness at sneak/webhooker

2026-08-12 12:42:53 +02:00

ea92c616c2 Correct release-blocking documentation inaccuracies (closes #141)

clawbot created branch issue-141-release-readiness in sneak/webhooker

2026-08-12 12:42:53 +02:00

clawbot commented on issue sneak/AutistMask#268

2026-08-12 12:42:14 +02:00

fix: Back after reopening the popup lands on a blank screen, because goBack() never re-renders

Fixed in #272.

The per-view dispatch and data guards move out of restoreView() into src/popup/viewRouter.js; goBack() routes a popped view…

clawbot created pull request sneak/AutistMask#272

2026-08-12 12:42:05 +02:00

fix: render the view "Back" lands on after the popup is reopened (closes #268)

clawbot created branch fix/issue-268-goback-rerender in sneak/AutistMask

2026-08-12 12:41:38 +02:00

clawbot pushed to fix/issue-268-goback-rerender at sneak/AutistMask

2026-08-12 12:41:38 +02:00

21b158b3b6 fix: render the view "Back" lands on after the popup is reopened (closes #268)

clawbot commented on issue sneak/webhooker#139

2026-08-12 12:38:35 +02:00

The receiver rate limit is per-URL-path, so an attacker gets unlimited aggregate rate against /webhook/*

PR: sneak/webhooker#143

Added an IP-only aggregate limiter in front of the existing per-entrypoint one over /webhook/*, at 10 * RECEIVER_RATE_LIMIT per minute…

clawbot commented on issue sneak/webhooker#140

2026-08-12 12:38:29 +02:00

RETENTION_SWEEP_INTERVAL is not range-checked, so a non-positive value panics two goroutines after startup reports success

Fixed in sneak/webhooker#142.

RETENTION_SWEEP_INTERVAL now goes through a new envPositiveDuration, which wraps envDuration the way envPort wraps envPositiveInt…

clawbot created pull request sneak/webhooker#143

2026-08-12 12:38:21 +02:00

Bound the receiver rate limit per client IP across /webhook/* (closes #139)

clawbot created pull request sneak/webhooker#142

2026-08-12 12:38:20 +02:00

Require a positive RETENTION_SWEEP_INTERVAL (closes #140)

clawbot pushed to issue-139-aggregate-receiver-ratelimit at sneak/webhooker

2026-08-12 12:38:02 +02:00

b5b3e1a926 Bound the receiver rate limit per client IP across /webhook/* (closes #139)

clawbot created branch issue-139-aggregate-receiver-ratelimit in sneak/webhooker

2026-08-12 12:38:02 +02:00

clawbot pushed to issue-140-retention-sweep-interval-bound at sneak/webhooker

2026-08-12 12:37:55 +02:00

500f39ac01 Require a positive RETENTION_SWEEP_INTERVAL (closes #140)

clawbot created branch issue-140-retention-sweep-interval-bound in sneak/webhooker

2026-08-12 12:37:55 +02:00

clawbot commented on issue sneak/webhooker#141

2026-08-12 12:32:43 +02:00

Release-readiness accuracy: docs contradict the code, TODO.md omits landed units, debug logging in the production asset

Plan, for the one item with a real choice in it (3):

Redelivery does not exist in the tree (only a comment in internal/delivery/engine.go mentions the word), so the README claim is what is…

clawbot opened issue sneak/webhooker#141

2026-08-12 12:30:13 +02:00

Release-readiness accuracy: docs contradict the code, TODO.md omits landed units, debug logging in the production asset