The endpoint ratchet sees the patient-SMS relay's internal-auth guard

Shipped: October 28, 2026 at 3:46 AM UTC
Author: Kamo
Commit: 9ca177b

**************** flagged **************** and .receipt (29e22ca7) as endpoints that resolve no session. They are server-to-server (VOIPService -> SecurityService) and were already guarded: a constant-time X-Internal-Auth check against internal.auth.secret, refusing everything when the secret is unset. The scan reads one method body and did not recognise the private helper's name. Renamed it to validateInternalAuth, the name the ratchet and the other internal controllers already use. No behaviour change.

All changes

Like what you see shipping?

All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.

Start Free Forever View Pricing