fix(security): SSRF pinning, Twilio webhook auth, copilot token leak, audit-log tenant scoping - #4899

Merged

waleedlatif1 merged 10 commits into

Jun 6, 2026

Commits on Jun 6, 2026

fix(clickhouse): pin outbound HTTP connection to validated IP (DNS rebinding)
waleedlatif1
committed
c66a882
fix(mcp): pin auth-type probe to validated IP to close SSRF/DNS-rebinding window
waleedlatif1
committed
37373b8
fix(security): stop returning plaintext OAuth access tokens from copilot credentials
waleedlatif1
committed
e64b703
fix(webhooks): verify X-Twilio-Signature on Twilio SMS webhooks
waleedlatif1
committed
5e067b2
fix(connectors): route user-controlled connector hosts through DNS-validated, IP-pinned fetch
waleedlatif1
committed
715e672
fix(audit-logs): scope enterprise audit log access to organization boundary
waleedlatif1
committed
0f7bf96
fix(webhooks): warn when Twilio webhook has no auth token configured
waleedlatif1
committed
720b203
fix(audit-logs): include system events (null actor) in default org audit scope
waleedlatif1
committed
4427bb5
fix(auth): type-safe access to OAuth2Tokens raw payload
waleedlatif1
committed
4a7c354
fix(build): keep connector SSRF fetch out of the client bundle
waleedlatif1
committed
69b3857