- Shipped
- October 14, 2026 at 4:30 PM UTC
- Author
- Kamo
- Commit
- 7c1c950
The service side of kamo-shared-library e58f1a93 (target vetting + DNS pinning, failure categories, encrypted signing secrets). - **************** (re-runnable; applied 2026-10-14 as owner kamo): adds webhook_subscriptions. signing_secret_ciphertext and rewrites legacy free-text failure reasons to categories. - WebhookSigningSecretMigration: SQL cannot encrypt (the platform key lives only in the app), so on every boot this moves any plaintext SIGNING_SECRET into the ciphertext column and nulls the plaintext. Idempotent, per row, never fails the boot. Production held 0 rows. - **************** a target URL the guard refuses is answered 400 with its fixed text instead of 404 "not found".