Marc-André Bombeck a1ffa497f1 fix(security): Withings webhook secret as URL path segment, not query string ...

Move the Withings webhook shared secret from `?secret=…` to a path
segment (`/api/withings/webhook/<secret>`) so it never lands in the
reverse-proxy `query_string` access-log column or GlitchTip URL/
breadcrumb capture surface (W10 finding M-2).

Withings has no facility for custom HTTP headers on outgoing
notifications and never signs the body — every Notify.subscribe call
accepts only action/callbackurl/appli/client_id/nonce/signature, so
the callback URL is the only authenticity surface a subscriber
controls. Path-segment binding is the largest practical shift away
from loggable query strings that Withings supports end-to-end.

The legacy `/api/withings/webhook` route stays alive for one release
cycle (removal target: v1.4.27) so existing subscriptions keep
delivering. The query-string path now emits a deprecation breadcrumb
on every hit. Active users re-subscribe organically when they reconnect
for the v1.4.25 `user.activity` OAuth-scope upgrade.

Tests: 8 new for the path-segment route (valid / invalid / missing /
unset-env / prefix-match / rate-limited / HEAD / GET), 3 new for
`getWithingsWebhookCallbackUrl()`. Existing legacy-route tests
continue to pass over the refactored shared helper.

2026-05-14 17:46:25 +02:00

..

research

docs(planning): note Fix-E confirms C2 sleep-suffix translations were already complete (W10 reconcile-A follow-up)

2026-05-14 17:06:43 +02:00

coolify-auto-deploy-howto.md

chore(security): MED cluster — Coolify URL scrub + isCurrent device-id + SLEEP_DURATION migration note

2026-05-11 02:44:12 +02:00

feature-user-timezone.md

docs(planning): per-user timezone proposal — long-form record for v1.5

2026-05-12 22:45:42 +02:00

phase-0-report.md

chore(planning): bootstrap v1.4.19 marathon

2026-05-10 12:51:33 +02:00

phase-1-report.md

chore(format): prettier sweep over phase-2 touched files + stale planning docs

2026-05-09 16:06:52 +02:00

phase-2-report.md

chore(planning): phase 2 done — v1.4.6 deferred backlog cleared

2026-05-09 16:08:20 +02:00

phase-3-report.md

docs(planning): record phase-7 pre-release verification

2026-05-09 18:08:25 +02:00

phase-4-report.md

docs(planning): record phase-7 pre-release verification

2026-05-09 18:08:25 +02:00

phase-4b-report.md

chore(planning): mark Phase 4b admin refactor complete

2026-05-09 17:02:59 +02:00

phase-5-report.md

docs(planning): record phase-7 pre-release verification

2026-05-09 18:08:25 +02:00

phase-7-report.md

docs(planning): record phase-7 pre-release verification

2026-05-09 18:08:25 +02:00

phase-A1-A3-report.md

docs(planning): file v1.4.18 reconcile + v1.4.19 backlog + v1.5 update

2026-05-10 11:09:41 +02:00

phase-A1-report.md

docs(planning): A1 report + STATE update for BD-Zielbereich fix

2026-05-10 13:02:39 +02:00

phase-A2-A6-report.md

docs(planning): file v1.4.18 reconcile + v1.4.19 backlog + v1.5 update

2026-05-10 11:09:41 +02:00

phase-A2-mobile-findings.md

test(charts): mobile-viewport e2e spec for header layout + tick density

2026-05-10 13:12:11 +02:00

phase-A2-report.md

docs(planning): A2 report + STATE update for charts mobile audit

2026-05-10 13:15:14 +02:00

phase-A3-report.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-A4-A5-A8b-report.md

docs(planning): file v1.4.18 reconcile + v1.4.19 backlog + v1.5 update

2026-05-10 11:09:41 +02:00

phase-A4-report.md

feat(integrations): IntegrationStatusPill component (single tag, mobile-safe)

2026-05-10 13:00:11 +02:00

phase-A5-report.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-A6-report.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-A6-settings-audit.md

test(insights): coverage for v1.4.19 polish changes

2026-05-10 13:16:19 +02:00

phase-A7-A8a-report.md

docs(planning): file v1.4.18 reconcile + v1.4.19 backlog + v1.5 update

2026-05-10 11:09:41 +02:00

phase-A7-report.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-A8-quality-findings.md

docs(planning): Phase B (A8 application) report + v1.4.20 backlog

2026-05-10 14:01:38 +02:00

phase-B1-report.md

docs(planning): file v1.4.18 reconcile + v1.4.19 backlog + v1.5 update

2026-05-10 11:09:41 +02:00

phase-B1-v1420-report.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-B1a-report.md

docs(planning): file v1.4.18 reconcile + v1.4.19 backlog + v1.5 update

2026-05-10 11:09:41 +02:00

phase-B1b-report.md

docs(planning): file v1.4.18 reconcile + v1.4.19 backlog + v1.5 update

2026-05-10 11:09:41 +02:00

phase-B2-report.md

docs(planning): file v1.4.18 reconcile + v1.4.19 backlog + v1.5 update

2026-05-10 11:09:41 +02:00

phase-B2a-report.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-B2b-report.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-B3-report.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-B4-report.md

docs(planning): mark Wave-B B4 complete + report

2026-05-10 17:24:59 +02:00

phase-B5-report.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-B5a-report.md

docs(planning): file v1.4.18 reconcile + v1.4.19 backlog + v1.5 update

2026-05-10 11:09:41 +02:00

phase-B5b-report.md

docs(planning): file v1.4.18 reconcile + v1.4.19 backlog + v1.5 update

2026-05-10 11:09:41 +02:00

phase-B5c-report.md

docs(planning): file v1.4.18 reconcile + v1.4.19 backlog + v1.5 update

2026-05-10 11:09:41 +02:00

phase-B5d-report.md

docs(planning): file v1.4.18 reconcile + v1.4.19 backlog + v1.5 update

2026-05-10 11:09:41 +02:00

phase-B5e-report.md

docs(planning): file v1.4.18 reconcile + v1.4.19 backlog + v1.5 update

2026-05-10 11:09:41 +02:00

phase-B6-report.md

docs(planning): mark phase B6 (settings naming-audit) complete

2026-05-10 00:29:22 +02:00

phase-B7-report.md

docs(planning): file v1.4.18 reconcile + v1.4.19 backlog + v1.5 update

2026-05-10 11:09:41 +02:00

phase-B8-report.md

docs(planning): file v1.4.18 reconcile + v1.4.19 backlog + v1.5 update

2026-05-10 11:09:41 +02:00

phase-B-mobile-report.md

docs(planning): file v1.4.18 reconcile + v1.4.19 backlog + v1.5 update

2026-05-10 11:09:41 +02:00

phase-B-quality-report.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-C1-report.md

docs(planning): file v1.4.18 reconcile + v1.4.19 backlog + v1.5 update

2026-05-10 11:09:41 +02:00

phase-C2-report.md

docs(planning): file v1.4.18 reconcile + v1.4.19 backlog + v1.5 update

2026-05-10 11:09:41 +02:00

phase-C3-report.md

docs(planning): file v1.4.18 reconcile + v1.4.19 backlog + v1.5 update

2026-05-10 11:09:41 +02:00

phase-C4-report.md

docs(planning): file v1.4.18 reconcile + v1.4.19 backlog + v1.5 update

2026-05-10 11:09:41 +02:00

phase-C5-report.md

docs(planning): file v1.4.18 reconcile + v1.4.19 backlog + v1.5 update

2026-05-10 11:09:41 +02:00

phase-C-report.md

docs(planning): file v1.4.18 reconcile + v1.4.19 backlog + v1.5 update

2026-05-10 11:09:41 +02:00

phase-D-c1-c2-wire-report.md

docs(planning): file v1.4.18 reconcile + v1.4.19 backlog + v1.5 update

2026-05-10 11:09:41 +02:00

phase-D-code-review-findings.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-D-design-findings.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-D-product-lead-review.md

docs(planning): file v1.4.18 reconcile + v1.4.19 backlog + v1.5 update

2026-05-10 11:09:41 +02:00

phase-D-reconcile-report.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-D-security-findings.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-D-senior-dev-findings.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-D-simplify-findings.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-D-v1418-product-lead-review.md

docs(planning): file v1.4.18 reconcile + v1.4.19 backlog + v1.5 update

2026-05-10 11:09:41 +02:00

phase-D-v1419-product-lead-review.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-D-v1420-code-review.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-D-v1420-design-review.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-D-v1420-product-lead-review.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-D-v1420-reconcile-report.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-D-v1420-security-review.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-D-v1420-senior-dev-review.md

docs(planning): record Wave D reconcile + carry-over backlog

2026-05-10 18:17:55 +02:00

phase-D-v1420-simplify-review.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-E1-report.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-E2-report.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-E3-report.md

docs(planning): bootstrap v1.4.20 STATE+ROADMAP, archive v1.4.19

2026-05-10 14:55:27 +02:00

phase-F1-report.md

docs(planning): F1 develop branch + FX user-facing cleanup recorded

2026-05-10 15:17:03 +02:00

phase-F2-report.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-F5-report.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-F6-report.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-FX-report.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-research-report.md

docs(planning): file v1.4.18 reconcile + v1.4.19 backlog + v1.5 update

2026-05-10 11:09:41 +02:00

phase-v1417-hotfix-report.md

docs(planning): file v1.4.18 reconcile + v1.4.19 backlog + v1.5 update

2026-05-10 11:09:41 +02:00

phase-v1421-hotfix-report.md

docs(planning): record v1.4.20.1 hotfix wave

2026-05-10 19:31:20 +02:00

phase-W1-v1423-research.md

docs(planning): land W1 research + W5/W6 review packs

2026-05-11 08:28:02 +02:00

phase-W1a-report.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-W1b-coach-prompt-research.md

docs(planning): land W1 research + W5/W6 review packs

2026-05-11 08:28:02 +02:00

phase-W2-report.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-W2-v1423-report.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-W2-v1425-ci-fix-report.md

chore: resolve parallel-agent merge conflicts + sweep up loose edits

2026-05-14 14:19:08 +02:00

phase-W3-report.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-W3-v1423-report.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-W3e-v1425-zielwerte-redesign-report.md

chore: resolve parallel-agent merge conflicts + sweep up loose edits

2026-05-14 14:19:08 +02:00

phase-W3f-v1425-polish-wins-report.md

chore: resolve parallel-agent merge conflicts + sweep up loose edits

2026-05-14 14:19:08 +02:00

phase-W4-report.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-W4-v1423-report.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-W4-v1425-insights-sub-pages-report.md

chore: resolve parallel-agent merge conflicts + sweep up loose edits

2026-05-14 14:19:08 +02:00

phase-W4d-v1425-glp1-full-report.md

chore: resolve parallel-agent merge conflicts + sweep up loose edits

2026-05-14 14:19:08 +02:00

phase-W5-v1422-code-review.md

docs(planning): land W1 research + W5/W6 review packs

2026-05-11 08:28:02 +02:00

phase-W5-v1422-design-review.md

docs(planning): land W1 research + W5/W6 review packs

2026-05-11 08:28:02 +02:00

phase-W5-v1422-product-lead-review.md

docs(planning): land W1 research + W5/W6 review packs

2026-05-11 08:28:02 +02:00

phase-W5-v1422-reconcile-report.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-W5-v1422-security-review.md

docs(planning): land W1 research + W5/W6 review packs

2026-05-11 08:28:02 +02:00

phase-W5-v1422-senior-dev-review.md

docs(planning): land W1 research + W5/W6 review packs

2026-05-11 08:28:02 +02:00

phase-W5-v1422-simplify-review.md

docs(planning): land W1 research + W5/W6 review packs

2026-05-11 08:28:02 +02:00

phase-W5-v1423-report.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

phase-W5-v1425-coach-polish-report.md

chore: resolve parallel-agent merge conflicts + sweep up loose edits

2026-05-14 14:19:08 +02:00

phase-W6-v1423-code-review.md

docs(planning): land W1 research + W5/W6 review packs

2026-05-11 08:28:02 +02:00

phase-W6-v1423-design-review.md

docs(planning): land W1 research + W5/W6 review packs

2026-05-11 08:28:02 +02:00

phase-W6-v1423-product-lead-review.md

docs(planning): land W1 research + W5/W6 review packs

2026-05-11 08:28:02 +02:00

phase-W6-v1423-reconcile-report.md

chore(release): v1.4.24

2026-05-12 22:33:35 +02:00

phase-W6-v1423-security-review.md

docs(planning): land W1 research + W5/W6 review packs

2026-05-11 08:28:02 +02:00

phase-W6-v1423-senior-dev-review.md

docs(planning): land W1 research + W5/W6 review packs

2026-05-11 08:28:02 +02:00

phase-W6-v1423-simplify-review.md

docs(planning): land W1 research + W5/W6 review packs

2026-05-11 08:28:02 +02:00

phase-W6c-v1425-doctor-report-toggles-report.md

chore: resolve parallel-agent merge conflicts + sweep up loose edits

2026-05-14 14:19:08 +02:00

phase-W7-v1425-timezone-report.md

chore: resolve parallel-agent merge conflicts + sweep up loose edits

2026-05-14 14:19:08 +02:00

phase-W7b-v1425-timezone-followup-report.md

chore: resolve parallel-agent merge conflicts + sweep up loose edits

2026-05-14 14:19:08 +02:00

phase-W8d-v1425-ah-server-prep-report.md

docs(planning): W8d v1.4.25 AH-server-prep phase report

2026-05-14 16:07:50 +02:00

phase-W9-v1425-repo-polish-report.md

chore: resolve parallel-agent merge conflicts + sweep up loose edits

2026-05-14 14:19:08 +02:00

phase-W9e-v1425-translations-report.md

docs(planning): W9f hot-fixes addendum to W9e phase report

2026-05-14 15:55:42 +02:00

phase-W17a-v1425-withings-webhook-secret-report.md

fix(security): Withings webhook secret as URL path segment, not query string

2026-05-14 17:46:25 +02:00

phase-wave-a-gate-report.md

docs(planning): file v1.4.18 reconcile + v1.4.19 backlog + v1.5 update

2026-05-10 11:09:41 +02:00

PROJECT.md

chore(planning): bootstrap v1.4.6 marathon

2026-05-09 01:22:09 +02:00

ROADMAP.md

chore: resolve parallel-agent merge conflicts + sweep up loose edits

2026-05-14 14:19:08 +02:00

STATE.md

chore: sync develop with v1.4.24 release from main

2026-05-14 11:32:28 +02:00

v15-backlog.md

docs(planning): per-user timezone proposal — long-form record for v1.5

2026-05-12 22:45:42 +02:00

v1415-backlog.md

chore(release): rebrand release artifacts as v1.4.14 (patch, not minor)

2026-05-09 17:57:30 +02:00

v1416-backlog.md

docs(planning): file v1.4.18 reconcile + v1.4.19 backlog + v1.5 update

2026-05-10 11:09:41 +02:00

v1416-research-ai-recommendations.md

docs(planning): file v1.4.18 reconcile + v1.4.19 backlog + v1.5 update

2026-05-10 11:09:41 +02:00

v1417-replace-audit.md

docs(planning): file v1.4.18 reconcile + v1.4.19 backlog + v1.5 update

2026-05-10 11:09:41 +02:00

v1418-achievements-research.md

docs(planning): file v1.4.18 reconcile + v1.4.19 backlog + v1.5 update

2026-05-10 11:09:41 +02:00

v1419-a2-prod-probe.mjs

test(charts): mobile-viewport e2e spec for header layout + tick density

2026-05-10 13:12:11 +02:00

v1419-backlog.md

style(planning): prettier sweep on reconcile + v1.4.19 backlog

2026-05-10 11:10:59 +02:00

v1420-backlog.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

v1420-marathon-handoff.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

v1421-backlog.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

v1422-backlog.md

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

v1423-backlog.md

chore(release): v1.4.24

2026-05-12 22:33:35 +02:00

v1425-handoff.md

docs(planning): v1.4.25 session handoff document

2026-05-14 14:22:17 +02:00