sandrodachandClaude Opus 5.5 300fd6a7be fix(security): API keys only deliver data; one auth check everywhere ...

Until API keys get scopes they have exactly one right: POST /api/v1/inbox
(thought or task via target) and the webhook ingest; every other endpoint
answers 403 for a key. Middleware and webhook ingest share one token check
(revocation list, token_version, active account), closing FLAW-08.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-29 07:39:29 +01:00

..

docsync_test.go

feat(notes): compact the operation log and purge old tombstones

2026-10-28 15:08:13 +01:00

docsync.go

feat(notes): compact the operation log and purge old tombstones

2026-10-28 15:08:13 +01:00

mail_test.go

fix(smtp): AUTH LOGIN fallback when PLAIN is refused

2026-10-29 00:09:27 +01:00

mail.go

fix(smtp): AUTH LOGIN fallback when PLAIN is refused

2026-10-29 00:09:27 +01:00

netguard_test.go

fix(security): SSRF protection for alarm webhooks (FLAW-05)

2026-10-29 07:37:39 +01:00

netguard.go

fix(security): SSRF protection for alarm webhooks (FLAW-05)

2026-10-29 07:37:39 +01:00

realtime_test.go

feat(notes): push, long polling and fallback detection for note sync

2026-10-28 14:10:29 +01:00

server_test.go

fix(security): API keys only deliver data; one auth check everywhere

2026-10-29 07:39:29 +01:00

server.go

fix(security): API keys only deliver data; one auth check everywhere

2026-10-29 07:39:29 +01:00