SSRF Defense Has to Survive DNS, Redirects, and Replay
Validating a webhook destination when it is saved is useful feedback, but the security boundary is the address selected at dial time on every delivery path.
Topic
Signalbin
A collection of 6 issues
An SSE Test Exposed a Real ResponseWriter Data Race
Signalbin's SSE handler was fine, but its test read an httptest.ResponseRecorder while another goroutine wrote to it. A synchronized wrapper fixed the test contract.
One Webhook Product, Four Interfaces, and the Drift Between Them
Signalbin exposed the same product through a web UI, REST API, MCP server, and agent skill. Their shared backend did not keep their capabilities aligned.
Why Signalbin Replaced Forwarding Rules With Destinations
Signalbin's forwarding rules mixed selection and delivery. Replacing them with destinations made fan-out, replay, health, and failure behavior explicit.
Making a React Marketing Site Crawlable Without Adopting a Framework
Signalbin kept its Vite React application and prerendered a fixed marketing route manifest into complete HTML, with tests to stop metadata drift.
Why an Allowed IPv4 Address Looked Forbidden
An IPv4-mapped IPv6 address passed one family check, then was normalized with the wrong text and mask. Canonicalizing before adding the prefix fixed it.