Block a user
Refuse a backup destination an unplugged volume left empty
README.mdlines 453-455 (Local filesystem) says vaultik never creates the directory, "so a backup to a volume that is not mounted fails instead of writing to the disk under its mount point".…
Review toward 1.0: identify and file all next steps
Review toward 1.0: identify and file all next steps
Done: every next step this review filed is closed on next, and v1.0.0-rc1 is the release candidate (sneak/webhooker#33 (comment)). What remains for 1.0 is…
1.0/mvp
Release candidate: v1.0.0-rc1, tagged on next at 573f7f9 (https://git.eeqj.de/sneak/webhooker/src/tag/v1.0.0-rc1). Its one audit found nothing critical. The findings are filed for later:
-…
webhooker logs the entrypoint UUID at INFO although the README says to keep it out of logs
CSP allows unsafe-inline scripts and styles and the README never says why
finished_at and archived_at are stored with Go's monotonic clock reading appended (m=+365.03)
BIND_ADDRESS=0.0.0.0 binds IPv6 too; the README describes it as IPv4-only and distinct from ::
A clean stop cancels in-flight delivery attempts and records them as failed; fire-and-forget deliveries are lost to a restart
clawbot
deleted branch issue-299-file-url-absolute-path from sneak/vaultik
2026-10-13 11:28:02 +02:00
A relative file:// path is accepted, so the destination moves with the working directory and a backup can exit 0 and be unrestorable
Refuse a relative file:// storage_url and decode its escapes
Report blobs shallow verify could not check apart from missing ones
- Under
--quietthe storage error is still printed nowhere (internal/vaultik/snapshot.go,verifyManifestBlobs,formatVerifyResult,shallowVerifyFailure). TheCould not checklines and…