[ralyodio]

Security bump. @profullstack/webhooks 0.2.0's sender used fetch's default redirect:'follow', so a customer webhook URL that passes the public-address check could 302 a delivery to an internal address (SSRF). 0.2.1 uses redirect:'manual' and treats a 3xx as a failed delivery; no other API change (profullstack/webhooks#2).

• @profullstack/webhooks 0.2.0 -> 0.2.1 (package.json + bun.lock)
• version 0.4.1
• bun test tests/: 283 pass; tsc --noEmit clean

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​profullstack/​webhooks@​0.2.0 ⏵ 0.2.1	+1		+1

View full report

[github-actions]

ThreatCrush Security Scan

30 finding(s)

HIGH/CRITICAL: 2 | MEDIUM: 26 | LOW: 2

Severity	Rule	Location
HIGH	sh-remote-script-execution	public/install.sh:302
HIGH	sh-remote-script-execution	public/install.sh:305
MEDIUM	js-open-redirect	app/dashboard/[[...tab]]/page.tsx:67
MEDIUM	js-open-redirect	app/signup/page.tsx:46
MEDIUM	js-unescaped-html-sink	components/PitFooter.tsx:30
MEDIUM	js-open-redirect	components/PitSearch.tsx:118
MEDIUM	js-unescaped-html-sink	components/Tenant.tsx:29
MEDIUM	js-unescaped-html-sink	components/Tenant.tsx:30
MEDIUM	js-unescaped-html-sink	components/Tenant.tsx:78
MEDIUM	js-unescaped-html-sink	components/Tenant.tsx:150
MEDIUM	sql-template-interpolation	lib/db.ts:590
MEDIUM	sql-template-interpolation	lib/db.ts:1232
MEDIUM	redos-nested-quantifier	lib/markdown.ts:109
MEDIUM	sql-template-interpolation	lib/webhook-store.ts:95
MEDIUM	sql-template-interpolation	lib/webhook-store.ts:102
MEDIUM	sql-template-interpolation	lib/webhook-store.ts:108
MEDIUM	sql-template-interpolation	lib/webhook-store.ts:111
MEDIUM	sql-template-interpolation	lib/webhook-store.ts:116
MEDIUM	sql-template-interpolation	lib/webhook-store.ts:117
MEDIUM	sql-template-interpolation	lib/webhook-store.ts:121
MEDIUM	sql-template-interpolation	lib/webhook-store.ts:128
MEDIUM	sql-template-interpolation	lib/webhook-store.ts:133
MEDIUM	sql-template-interpolation	lib/webhook-store.ts:144
MEDIUM	sql-template-interpolation	lib/webhook-store.ts:154
MEDIUM	sql-template-interpolation	lib/webhooks.ts:207
MEDIUM	sh-remote-script-execution	public/install.sh:123
MEDIUM	sh-remote-script-execution	public/install.sh:127
MEDIUM	sh-remote-script-execution	public/install.sh:146
LOW	secret-generic-credential	tests/signup-profile.test.mjs:28
LOW	secret-generic-credential	tests/signup-profile.test.mjs:39

Snippets are redacted; ThreatCrush never prints matched credential material.