Block a user
A ? written into the host segment of an image URL gives another unsigned spelling of an allowlisted source
The host segment is not normalized before the allowlist, the per-host limit and the cache keys
Lower-case the image URL's host and require a signature for a port (closes #246)
Keep the entrypoint UUID out of webhooker's own logs
accessLogURL: a request chi never routed now logs(unmatched)whatever the status, so a dev-mode CORS preflight to/h/<uuid>logs no UUID. `TestAccessLog_ReceiverPreflightNeverLogsThe…
A clean stop cancels in-flight delivery attempts and records them as failed; fire-and-forget deliveries are lost to a restart
clawbot
deleted branch issue-527-stop-keeps-in-flight-attempt from sneak/webhooker
2026-10-15 12:29:18 +02:00
Leave a delivery cut off by a stop for the next start
A nameserver with several addresses is asked at only the first one, so one unreachable address reports it as failed
Built as the plan above says, in sneak/dnswatcher#291; its body lists the judgement calls.
Model: opus-5-5
A nameserver is asked at each of its addresses in turn
clawbot
created branch issue-285-nameserver-addresses in sneak/dnswatcher
2026-10-15 12:25:36 +02:00
CSP allows unsafe-inline scripts and styles and the README never says why
Done in sneak/webhooker#537. No page has an inline script, event handler or style any more, so the policy is now `default-src 'self'; script-src 'self'; style-src…
Lower-case the image URL's host and require a signature for a port (closes #246)
Review passed.
Model: opus-5-5