docs: stop publishing Hookshot webhook IDs; record Hookshot + call-stack upgrades #55

Merged

jared merged 1 commits from docs/hookshot-ids-and-upgrades into main 2026-11-03 00:36:19 -05:00

Conversation 0 Commits 1 Files Changed 2

+85 -19

jared commented 2026-11-03 00:34:13 -05:00

Owner

Copy Link

Copy Source

Webhook IDs were public

The README's webhook table listed every Hookshot webhook's full UUID. The UUID is the webhook's only secret, and this repo is readable without logging in, so anyone could post fake Grafana, Proxmox or Uptime Kuma messages into Spam and Stuff. They had been there since 2026-02-20.

This PR:

• shortens all 13 IDs to their first 8 characters, which is still enough to match Hookshot's logs;
• adds a CI job, readme-no-webhook-ids, that rejects full UUIDs in README.md.

⚠️ The IDs stay in git history. Only rotating the webhooks closes the exposure, which means updating each sender's URL.

Docs

• Hookshot 7.5.0 (upgraded 2026-11-03): how it's built (pnpm since 7.4.1, the pnpm wrapper build-app.sh needs, and 7.6.0 dropping Node 22), plus the build-and-swap procedure.
• Planned lk-jwt-service 0.9.0 / LiveKit 1.13.11 upgrade, from local testing:
  • the LiveKit webhook that delegated leave needs, without which crashed clients linger for an hour;
  • the prometheus_port → prometheus.port change;
  • restart caveats.
• Graceful restart: describes the fixed check from #54.

🤖 Generated with Claude Code

https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

## Webhook IDs were public The README's webhook table listed every Hookshot webhook's **full UUID**. The UUID is the webhook's only secret, and this repo is readable without logging in, so anyone could post fake Grafana, Proxmox or Uptime Kuma messages into Spam and Stuff. They had been there since 2026-02-20. This PR: - shortens all 13 IDs to their first 8 characters, which is still enough to match Hookshot's logs; - adds a CI job, `readme-no-webhook-ids`, that rejects full UUIDs in `README.md`. ⚠️ The IDs stay in git history. Only **rotating** the webhooks closes the exposure, which means updating each sender's URL. ## Docs - **Hookshot 7.5.0** (upgraded 2026-11-03): how it's built (pnpm since 7.4.1, the pnpm wrapper `build-app.sh` needs, and 7.6.0 dropping Node 22), plus the build-and-swap procedure. - **Planned lk-jwt-service 0.9.0 / LiveKit 1.13.11 upgrade**, from local testing: - the LiveKit webhook that delegated leave needs, without which crashed clients linger for an hour; - the `prometheus_port` → `prometheus.port` change; - restart caveats. - **Graceful restart**: describes the fixed check from #54. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

jared added 1 commit 2026-11-03 00:34:13 -05:00

docs: stop publishing Hookshot webhook IDs; record the Hookshot and call-stack upgrades ... 6e41477a0b

- The README's webhook table listed every Hookshot webhook's full UUID.
  The UUID is the webhook's only secret and this repo is public, so
  anyone could post into Spam and Stuff. Shorten them to 8 characters
  and add CI (readme-no-webhook-ids) rejecting full UUIDs in README.md.
  They remain in git history until rotated.
- Hookshot is now 7.5.0: how it's built (pnpm 7.4.1+, Node 22 limit
  of 7.6.0) and how to swap a new build in.
- Planned lk-jwt-service 0.9.0 / LiveKit 1.13.11 upgrade: the LiveKit
  webhook delegated leave needs, the prometheus config key, and
  restart caveats, from local testing.
- Graceful restart: describe the fixed check (#54).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

jared scheduled this pull request to auto merge when all checks succeed 2026-11-03 00:34:25 -05:00

jared merged commit a06ebfe6f6 into main 2026-11-03 00:36:19 -05:00

jared deleted branch docs/hookshot-ids-and-upgrades 2026-11-03 00:36:21 -05:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

Something is broken

ci

CI / workflows

enhancement

New feature or request

infra

Infrastructure / runners / servers

landing

priority: low

priority: medium

security

Security or privacy

ux

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

cole (Cole Keller) jared (Jared Vititoe) nathan (Nathan Vititoe)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: LotusGuild/matrix#55