4 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
sneak	def52ae092	State the UUID-is-the-credential rule as a rule (closes #301) ... The receiver has authenticated on the entrypoint UUID alone since inbound signature verification was removed in #279. The README described that as the current state; it did not say it is the decision. Restate it as the rule, so a proposal to add HMAC, a shared secret or a bearer token to the receiver is contradicted by the docs rather than merely unimplemented. The rule now appears in the intro, in its own section, and in the Authentication and Security lists, and carries the two consequences an operator has to act on: the URL is a capability to be kept out of logs and tickets, and rotation means minting a new entrypoint rather than changing a key. Also corrects one stale comment: a redirect test said the inbound signature was one "the receiver verifies", which in this repo's vocabulary names webhooker's own receiver. The endpoint that verifies it is the delivery target's.	2026-08-25 20:38:47 +00:00
sneak	2cc8723997	scripts-to-rule-them-all (#59) ... Reviewed-on: #59 Co-authored-by: sneak <sneak@sneak.berlin> Co-committed-by: sneak <sneak@sneak.berlin>	2026-07-07 02:14:09 +02:00
sneak	e0b1e7cf54	Restore TODO.md and move TODO content out of README (#58) ... Reviewed-on: #58 Co-authored-by: sneak <sneak@sneak.berlin> Co-committed-by: sneak <sneak@sneak.berlin>	2026-07-06 21:14:03 +02:00
sneak	1244f3e2d5	initial	2026-03-01 22:52:08 +07:00