- Shipped
- September 6, 2026 at 10:32 PM UTC
- Author
- Kamo
- Commit
- ea6d631
The phone-server inbound path added in the previous commit verified against whatever provider carried the number. That is a forgery surface, and not hypothetically: **************** is `return true`, and RingCentral's is `return true; // TODO`. The endpoint is unauthenticated by construction — a carrier holds no credential but its own signature — so a number routed at either of those phone servers would have let anyone who knew that number POST inbound messages into the organization's threads. Including STOP, which would stop the tenant texting a customer who never asked to be left alone. The slug in the URL says which carrier posted. Only a phone server from the same company may verify it; anything else is refused before its signature check is consulted at all. Matched on the enum name rather than a hardcoded TELNYX, so the next provider that is both a phone server and a carrier works without pretending any other pairing has been considered. The test was probed the way this repository's guards are meant to be: the check was disabled on purpose and the test named it.