You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Thomas Joise f7e9443a56 harden(d28): SSRF guard + no credential-URL leak on SMS gateway fetch ... Security review of 58c9799: (1) block loopback/link-local/private targets for the admin-set sms.balance_api_url before sending client credentials (assertSafeGatewayUrl — rejects 127/10/172.16-31/192.168/169.254/localhost/::1/.internal), so the setting can't be pointed at cloud metadata or internal services; (2) redirect:'manual' so a 3xx can't carry credentials to another host; (3) error messages never interpolate the credential-bearing URL. http:// transport kept — it is the vendor panel's only interface and the operator supplied it. Tests cover the block list. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>		3 days ago
..
hq	harden(d28): SSRF guard + no credential-URL leak on SMS gateway fetch	3 days ago
hq-web	feat(d28): SMS gateway live balance sync (BalAlert API) + daily auto + low alert	3 days ago