webhooker

Slack webhook credential still leaks via delivery errors, SSRF logs, and the source_logs template data

#118 by clawbot was closed 2026-08-11 15:11:58 +02:00 1.0.0

2

Source detail page renders raw target config, exposing the Slack webhook URL credential

#113 by clawbot was closed 2026-08-11 14:37:10 +02:00 1.0.0

1

TOP PRIORITY: consolidate all open PRs onto one next branch, one PR

#110 by clawbot was closed 2026-08-11 13:56:44 +02:00

3

CRITICAL: delivery engine and retention reaper both die ~15s after startup (fx OnStart context)

#97 by clawbot was closed 2026-08-10 15:44:56 +02:00

1

Enforce request body size limit before CSRF middleware parses the form

#90 by clawbot was closed 2026-08-11 14:37:39 +02:00

2

Archive writer lifecycle: evict writers on webhook deletion and sweep idle archives

#89 by clawbot was closed 2026-08-10 15:52:21 +02:00

2

Recovery skips orphaned retrying deliveries whose target type changed to a non-retry type

#82 by clawbot was closed 2026-08-10 16:00:04 +02:00

2

Config parsing should fail loudly on set-but-unparseable env values (envInt, etc.)

#80 by clawbot was closed 2026-08-10 16:06:12 +02:00

2

RetentionDays cannot be set to 0 (retain forever) via the normal create path

#79 by clawbot was closed 2026-08-11 14:35:35 +02:00

4

Refactor delivery targets to a Target interface

#77 by clawbot was closed 2026-08-07 17:07:49 +02:00 1.0.0

5

Implement the log delivery target

#70 by clawbot was closed 2026-08-07 15:26:46 +02:00 1.0.0

2

Keep the SSRF-safe Transport in clientForConfig when a per-target timeout is set

#69 by clawbot was closed 2026-08-07 14:03:38 +02:00 1.0.0

1

Validate Slack target URLs at creation time (SSRF parity with HTTP targets)

#68 by clawbot was closed 2026-08-07 14:03:56 +02:00 1.0.0

1

Add inactivity-based session timeout

#66 by clawbot was closed 2026-08-10 16:12:40 +02:00

2

Add an admin password change flow in the web UI

#65 by clawbot was closed 2026-08-07 23:23:05 +02:00 1.0.0

1

Rate-limit the public webhook receiver endpoint

#64 by clawbot was closed 2026-08-11 14:47:22 +02:00 1.0.0

1

Enforce per-webhook event retention (RetentionDays reaper)

#63 by clawbot was closed 2026-08-07 16:15:14 +02:00 1.0.0

1

Reconcile HTTP WriteTimeout with the request middleware timeout

#62 by clawbot was closed 2026-08-07 13:58:29 +02:00 1.0.0

1

Set Cache-Control: no-store on authenticated pages

#61 by clawbot was closed 2026-08-07 15:33:45 +02:00 1.0.0

1

Wrap the /user/{username} route in RequireAuth middleware

#60 by clawbot was closed 2026-08-07 14:00:17 +02:00 1.0.0

1