You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Thomas Joise f7e9443a56 harden(d28): SSRF guard + no credential-URL leak on SMS gateway fetch ... Security review of 58c9799: (1) block loopback/link-local/private targets for the admin-set sms.balance_api_url before sending client credentials (assertSafeGatewayUrl — rejects 127/10/172.16-31/192.168/169.254/localhost/::1/.internal), so the setting can't be pointed at cloud metadata or internal services; (2) redirect:'manual' so a 3xx can't carry credentials to another host; (3) error messages never interpolate the credential-bearing URL. http:// transport kept — it is the vendor panel's only interface and the operator supplied it. Tests cover the block list. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>		3 days ago
..
scripts	feat(d20): importer v2 rework from the 46-agent real-data audit	4 days ago
src	harden(d28): SSRF guard + no credential-URL leak on SMS gateway fetch	3 days ago
test	harden(d28): SSRF guard + no credential-URL leak on SMS gateway fetch	3 days ago
.env.example	feat(deploy): hardcode DB connection + owner email (no .env), update docs	4 days ago
build-server.mjs	feat(hq): server assembly, build script and e2e smoke (HQ-1 task 14)	2 weeks ago
package.json	feat(d20): P4 — full-APEX importer v2 (9 files, stage/commit, CLI)	4 days ago
schema.sql	docs+chore: HQ DDL snapshot, gitignored import-drop, Postgres locked pre-go-live (D15)	2 weeks ago
tsconfig.json	feat(hq): app skeleton with health endpoint (HQ-1 task 1)	2 weeks ago