5 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
sneak	bacd6f419f	Stop describing dev as the default environment ... Comments in reqtls and session, and the README Quick Start and deployment checklist, still spoke as if an unset WEBHOOKER_ENVIRONMENT meant dev. The checklist now asks only that the environment is not dev (unset or prod); the Quick Start describes running from the clone. Model: opus-5-5	2026-09-28 09:19:12 +00:00
sneak	303fe42c86	Default WEBHOOKER_ENVIRONMENT to prod ... An unset WEBHOOKER_ENVIRONMENT now resolves to prod rather than dev, so an operator who forgets the variable is not silently permissive. The only behaviour dev still changes is the CORS middleware, which answers every origin with Access-Control-Allow-Origin: *; that is now off unless dev is set explicitly. Cookie Secure and CSRF strictness are decided per request from the transport and are unaffected. Updated resolveEnvironment and its comment, the README configuration table and prose, and tests covering the default and the explicit dev. Comments that justified behaviour by the old dev default (the TRUSTED_PROXIES warning, a CSRF test) were corrected; that warning still fires in every environment when TRUSTED_PROXIES is empty. Model: opus-4-8	2026-09-28 09:17:52 +00:00
sneak	2cc8723997	scripts-to-rule-them-all (#59) ... Reviewed-on: #59 Co-authored-by: sneak <sneak@sneak.berlin> Co-committed-by: sneak <sneak@sneak.berlin>	2026-07-07 02:14:09 +02:00
sneak	e0b1e7cf54	Restore TODO.md and move TODO content out of README (#58) ... Reviewed-on: #58 Co-authored-by: sneak <sneak@sneak.berlin> Co-committed-by: sneak <sneak@sneak.berlin>	2026-07-06 21:14:03 +02:00
sneak	1244f3e2d5	initial	2026-03-01 22:52:08 +07:00