Paulo Castellano 11d6bddf9c fix(security): guard automation node requests against redirect-SSRF ... RunFetchRssNode, RunWebhookNode and RunHttpRequestNode guarded the initial URL but then followed redirects unguarded, so a public URL could 302 to an internal address. RSS now fetches through SafeHttpFetcher::get() (re-guards every hop); webhooks no longer follow redirects; the generic HTTP request node re-runs the SSRF guard on each hop via a new SafeHttpFetcher::redirectGuardOptions().		2026-07-17 14:55:56 -03:00
..
Ai	feat: per-workspace pricing, onboarding, and billing overhaul	2026-06-21 20:40:03 -03:00
Automation	fix(security): guard automation node requests against redirect-SSRF	2026-07-17 14:55:56 -03:00
Billing	Limit the $1 first month to a new customer's single workspace	2026-07-09 15:51:50 -03:00
Invite	fix(members): preserve invited role on accept and surface viewer in role menu	2026-06-22 14:24:19 -03:00
Label	refactor: restructure to Actions, subdomain routes (app/api), API tokens	2026-03-29 19:24:28 -03:00
Post	refactor(api): extract inline-media hosting into a HostInlineMedia action	2026-06-28 21:15:01 -03:00
PostComment	feat: @mentions in comments, AI Action layer + MCP tools, settings tabs	2026-05-01 20:59:03 -03:00
Signature	chore: remove deprecated localization files	2026-05-03 15:23:25 -03:00
SocialAccount	feat(telegram): surface connect failure in the dialog instead of silent expiry	2026-06-22 09:55:12 -03:00
User	fix(signup): keep default-workspace creation inside the registration transaction	2026-06-22 08:47:47 -03:00
Workspace	fix(workspace): default content_language to the app locale, not 'en'	2026-07-01 13:49:48 -03:00