An unguessable capability URL is the whole credential (closes #52) #53

clawbot · 2026-08-25T22:44:08+02:00

clawbot commented

2026-08-25 22:44:08 +02:00

Closes #52

The HTTP hardening section of REPO_POLICIES.md — which is synced into every
managed repo — ends with "When in doubt, harden." As written that authorises
adding HMAC signing or a shared secret on top of an endpoint already gated by an
unguessable per-entrypoint UUID URL, which has been ruled against twice; inbound
signature verification was removed from webhooker on exactly that reasoning.
Until now the only text contradicting the policy lived in webhooker's own
README.md, so a contributor could propose HMAC in good faith and cite the
policy for it.

This adds one scoped carve-out in the same paragraph block as that sentence, so
a reader hits it in the same breath: the URL is a complete credential and gets
no second authentication factor, not as defense-in-depth either. The
consequences that DO follow — it is a secret, so keep it out of logs and
tickets, and rotate by minting a new entrypoint — are stated, as is what to do
with a sender that only supports signed payloads.

Nothing in the surrounding hardening guidance is deleted or weakened.

Also bumps the document's last_modified front matter, which the repo's own
cross-project-docs rule requires on any change to this file.

Closes https://git.eeqj.de/sneak/prompts/issues/52 The HTTP hardening section of `REPO_POLICIES.md` — which is synced into every managed repo — ends with "When in doubt, harden." As written that authorises adding HMAC signing or a shared secret on top of an endpoint already gated by an unguessable per-entrypoint UUID URL, which has been ruled against twice; inbound signature verification was removed from `webhooker` on exactly that reasoning. Until now the only text contradicting the policy lived in `webhooker`'s own `README.md`, so a contributor could propose HMAC in good faith and cite the policy for it. This adds one scoped carve-out in the same paragraph block as that sentence, so a reader hits it in the same breath: the URL is a complete credential and gets no second authentication factor, not as defense-in-depth either. The consequences that DO follow — it is a secret, so keep it out of logs and tickets, and rotate by minting a new entrypoint — are stated, as is what to do with a sender that only supports signed payloads. Nothing in the surrounding hardening guidance is deleted or weakened. Also bumps the document's `last_modified` front matter, which the repo's own cross-project-docs rule requires on any change to this file.

clawbot added 1 commit 2026-08-25 22:44:09 +02:00

An unguessable capability URL is the whole credential (closes #52 )

check / check (push) Successful in 16s

Details

4e6a782edf

The HTTP hardening section ends with "when in doubt, harden", which as
written authorises adding HMAC signing or a shared secret on top of an
endpoint already gated by an unguessable per-entrypoint UUID URL. That
has been ruled against twice, and inbound signature verification was
removed from webhooker on exactly that reasoning; until now the only
text contradicting the policy was webhooker's own README.

Adds one scoped carve-out immediately after that sentence: such a URL is
a complete credential and gets no second factor, not even as defence in
depth. The consequences that do follow — keep it out of logs and
tickets, rotate by minting a new entrypoint — are stated, as is what to
do with a sender that only supports signed payloads. Nothing in the
surrounding hardening guidance is removed or weakened.

clawbot added the needs-review label 2026-08-25 22:44:26 +02:00

clawbot self-assigned this 2026-08-25 22:44:29 +02:00

clawbot referenced this pull request

2026-08-25 22:44:38 +02:00

REPO_POLICIES: carve out capability-URL services from "when in doubt, harden" #52

check / check (push) Successful in 16s

Details

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin issue-52-capability-url-carveout:issue-52-capability-url-carveout

git checkout issue-52-capability-url-carveout

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sneak/prompts#53