4 Commits

Include renames

Author	SHA1	Message	Date
Matthew MeszarosandDevin AI	925e0edc31	feat: proxy dashboard and editor image previews with SSRF-safe bounded fetching while preserving original customer email URLs ... Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>	2026-10-06 07:28:25 +00:00
Matthew Meszaros	41d43f64be	feat: check that a verified root redirect actually reaches visitors by opening the domain over http and https and naming what answered instead (Traefik, nginx, Caddy, a rewritten Host header, a missing certificate, a closed port) with per-proxy fix steps in the sending domain drawer, and let a self-hosted instance linked to Warmbly Cloud have Cloud serve and certify its redirects (connect in place from the redirect tab, the bulk dialog or a page banner), with Cloud-side linked-instance redirect endpoints under a per-instance limit, migration 000237, labelled tracking answers and a 503 when the redirect lookup is unavailable, and the sending domains, Warmbly Cloud, data control, install, OpenAPI, API and error code docs updated	2026-09-30 06:04:00 -07:00
Matthew Meszaros	0a81fd361b	feat: add safehttp dial-time SSRF guards and the whdomain subdomain-aware allowlist matcher used to harden outbound webhook delivery	2026-06-15 08:11:20 +02:00
Matthew Meszaros	1fa9c65ada	fix: harden every user-supplied-URL outbound path against SSRF with a shared dial-time guard (resolves the host, blocks private/loopback/link-local/metadata IPs, pins the validated IP to defeat DNS rebinding, re-validates redirects) and log automation HTTP requests + blocked attempts with org attribution	2026-06-13 13:34:19 +02:00