mirror of
https://github.com/vernu/textbee.git
synced 2026-07-31 01:17:52 -04:00
f65af5003b
The create dialog is mounted for the whole session, so its defaultValues, and the uuid inside them, were evaluated exactly once. A bare form.reset() then restored that same object, so every webhook created without reloading the page shared one signing secret. The secret is what proves a delivery genuinely came from us, so sharing it across endpoints means compromising any one of them compromises the rest. Build the defaults fresh on each use, and reset with a new secret both when the dialog opens and after a successful create. The e2e guard was confirmed to fail against the previous code, with both creates submitting an identical secret. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>