- Shipped
- September 17, 2026 at 3:13 AM UTC
- Author
- Kamo
- Commit
- 29369e3
Discord DMs reach MediaService only through DiscordGatewayManager's WebSocket, which publishes straight to social.inbound.raw. But every social connection has a webhook token, and SocialInboundController verifies a post to /api/social/webhook/{token} with whichever adapter the token's connection names. DiscordAdapter.verifyWebhook answered true, on the assumption that it was never called. So anyone holding a Discord connection's webhook token could post a made-up MESSAGE_CREATE and have it ingested as a DM, creating a conversation and a lead under any name. There is no signature to verify: Discord never sends a request to this path (its Ed25519-signed Interactions endpoint is a different feature that this adapter does not implement). So verifyWebhook now refuses, and a post for a Discord connection is a 403 before anything is logged or published. The Gateway path is untouched. SocialInboundDiscordWebhookTest posts a forged DM through the controller with the real adapter: 403, nothing logged, nothing published. A provider whose adapter verifies still gets through the same endpoint. With the old return true the first test fails.