sneak/webhooker
1
0
Fork 0
Code Issues 62 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

1.0.0

New Issue

Internet-facing 1.0.0 readiness. Tracks the remaining small, concrete tasks required before tagging 1.0.0 and exposing webhooker to the public internet. Discussion/context: #33. The five March security blockers (#34–#38) plus form body-size limits (#39) are already resolved; this milestone holds what is left.

No due date
100% Completed
Decision: should login rate limiting survive a shared bucket, or should TRUSTED_PROXIES be mandatory in production?
#150 by clawbot was closed 2026-08-18 01:55:42 +02:00
2
Default config allows a remote stranger to lock the operator out of the admin UI, and nothing warns about it
#149 by clawbot was closed 2026-08-12 13:49:39 +02:00
1
The access log writes one INFO line with the full attacker-controlled URL per request, including rejected ones
#146 by clawbot was closed 2026-08-18 00:32:29 +02:00
1
A minified vendored bundle is committed to the repo, which REPO_POLICIES forbids
#145 by clawbot was closed 2026-08-17 23:12:18 +02:00
1
Release-readiness accuracy: docs contradict the code, TODO.md omits landed units, debug logging in the production asset
#141 by clawbot was closed 2026-08-12 13:15:06 +02:00
2
RETENTION_SWEEP_INTERVAL is not range-checked, so a non-positive value panics two goroutines after startup reports success
#140 by clawbot was closed 2026-08-12 12:46:41 +02:00
1
The receiver rate limit is per-URL-path, so an attacker gets unlimited aggregate rate against /webhook/*
#139 by clawbot was closed 2026-08-12 13:19:43 +02:00
1
The event-log page renders stored bodies untruncated, so buffered rendering can hold ~25 MB per request
#135 by clawbot was closed 2026-08-17 22:57:09 +02:00
2
fx.StopTimeout is never set, so the bounded-shutdown fix does not fire under a default docker stop
#134 by clawbot was closed 2026-08-18 00:12:52 +02:00
3
The hop cap bounds the walk but not the Split: a 1 MB X-Forwarded-For still allocates ~8 MB per request
#133 by clawbot was closed 2026-08-12 12:19:14 +02:00
1
No target edit form: a target's destination URL, headers and timeout are write-once
#127 by clawbot was closed 2026-08-20 07:24:13 +02:00
1
Decision: should IPv6 rate-limit keys bucket by /64 rather than per-address?
#125 by clawbot was closed 2026-08-17 23:52:16 +02:00
1
Cap the X-Forwarded-For hop walk: an unbounded chain burns CPU on every request
#124 by clawbot was closed 2026-08-12 11:53:49 +02:00
1
CI can report success without running lint or tests, because script/cibuild replays a cached image
#119 by clawbot was closed 2026-08-12 13:00:52 +02:00
1
Slack webhook credential still leaks via delivery errors, SSRF logs, and the source_logs template data
#118 by clawbot was closed 2026-08-11 15:11:58 +02:00
2
Source detail page renders raw target config, exposing the Slack webhook URL credential
#113 by clawbot was closed 2026-08-11 14:37:10 +02:00
1
Two remaining delivery terminal-state gaps: opaque failure and deletion-orphaned retries
#107 by clawbot was closed 2026-08-24 05:12:03 +02:00
2
Gate forwarded-header trust behind trusted-proxy config in rate limiters
#88 by clawbot was closed 2026-08-12 11:36:11 +02:00
2
Refactor delivery targets to a Target interface
#77 by clawbot was closed 2026-08-07 17:07:49 +02:00
5
Implement the log delivery target
#70 by clawbot was closed 2026-08-07 15:26:46 +02:00
2