4 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
sneak	f32284a39f	Rate-limit the public webhook receiver endpoint (closes #64) ... The public receiver /webhook/{uuid} had no rate limiting: anyone who learns an entrypoint UUID can flood it, inflating the per-webhook database and the delivery queue. Add a dedicated limit scoped to the receiver route, keyed per client IP per request path (the path contains the entrypoint UUID), so one misbehaving sender is throttled without affecting other senders of the same entrypoint or other entrypoints. Requests over the limit get a 429; httprate adds the Retry-After header per RFC 6585. IP extraction honours X-Forwarded-For, X-Real-IP, and True-Client-IP for reverse-proxy deployments. The limit is RECEIVER_RATE_LIMIT requests per minute, default 120. A set-but-unparseable or non-positive value aborts startup via the new envPositiveInt strict parser rather than silently falling back to the default. envInt's other callers are unchanged; converting them is tracked in #80. Also update the README env table and Rate Limiting design section, and sync TODO.md.	2026-08-07 16:51:52 +00:00
sneak	2cc8723997	scripts-to-rule-them-all (#59) ... Reviewed-on: #59 Co-authored-by: sneak <sneak@sneak.berlin> Co-committed-by: sneak <sneak@sneak.berlin>	2026-07-07 02:14:09 +02:00
sneak	e0b1e7cf54	Restore TODO.md and move TODO content out of README (#58) ... Reviewed-on: #58 Co-authored-by: sneak <sneak@sneak.berlin> Co-committed-by: sneak <sneak@sneak.berlin>	2026-07-06 21:14:03 +02:00
sneak	1244f3e2d5	initial	2026-03-01 22:52:08 +07:00