sneak 5c0ea2b44f Mask the http target's destination URL in the UI (closes #115) ...

An http target's destination is frequently a Slack, Discord or
Teams incoming-webhook endpoint whose path segments are the
credential — the same property that made the Slack target's
webhook URL a bearer token. The source detail page rendered it
in full, so the leak closed for slack targets stayed reachable
through a different target type.

Render it through the existing MaskURL, which reduces a URL to
scheme and host. The field accepts an arbitrary URL, so no path
segment can be assumed non-secret and none is shown.

2026-08-12 09:40:43 +00:00

7.0 KiB

Raw Permalink Blame History

View Raw