KamoAI internal surface guarded by its own secret

Shipped

September 27, 2026 at 4:54 PM UTC

Author

Kamo

Commit

d628fe1

/api/voip/internal/** (SP13: AI lines, SIP credentials for LiveKit) takes KAMOAI_INTERNAL_SECRET, not the cluster secret; the cluster prefixes keep theirs. The filter matches the decoded path Spring MVC routes by, so an encoded letter (/api/voip/%69nternal/...) cannot skip either secret.