Harden webhook authentication and outbound fetch handling#13

Merged

kshahbw merged 11 commits into

adapter/contributing-guidefrom

adapter/webhook-callback-auth

Jul 15, 2026

Commits on Jul 15, 2026

feat(server): add constant-time credential comparison helper
kshahbw
committed
refactor(server): use constant-time comparison for REST facade auth
kshahbw
committed
feat(egress): add outbound fetch destination guard
kshahbw
committed
fix(egress): classify IPv6-literal hosts and normalize resolver failures
kshahbw
committed
feat(egress): constrain outbound customer fetches to public destinations
kshahbw
committed
feat(server): apply egress policy to Bandwidth webhook fetches
kshahbw
committed
feat(server): authenticate inbound Bandwidth webhooks with Basic auth
kshahbw
committed
feat(translator): attach callback credentials to emitted BXML callback verbs
kshahbw
committed
feat(server): default to loopback host and document webhook auth setup
kshahbw
committed
feat(egress): optional host allowlist for outbound fetches
kshahbw
committed
docs: clarify egress guard is defense-in-depth
kshahbw
committed