Marc-André Bombeck f2a9b0fc0e fix(deploy-webhook): accept signed requests and stop calling a bare timestamp replay protection ...

The deploy-status webhook authenticated with a static secret in a header,
and the timestamp the docs called replay protection was covered by nothing:
whoever captures one request holds the secret and can send a fresh request
with any content. The strict setting, documented as closing the replay
window completely, only made that timestamp mandatory.

A sender can now sign instead: X-Deploy-Webhook-Signature is the
HMAC-SHA256 of the timestamp and the exact body under the shared secret,
with the timestamp within five minutes, and the secret never travels. The
strict setting accepts only signed requests. The secret header still works
by default for senders that cannot sign, and the docs describe its
timestamp as the staleness hint it is.

2026-10-25 13:52:04 +01:00

..

migrations

feat(v1.4): multi-tenant prep — off-host backup, encryption-key versioning, worker/web split, native-Bearer UA gating (#135)

2026-05-08 14:33:39 +02:00

apple-health-distance-repair.md

fix(ops): stop the distance repair losing its rollup tail in silence

2026-09-10 00:37:15 +02:00

attempt-number-semantics.md

fix(integrations): log a failed sync as a signal, not an audit row

2026-10-20 10:03:30 +02:00

backup-restore.md

fix(backup): stream documents and ECG traces through backup and restore

2026-10-18 13:10:19 +02:00

blood-pressure-missing-diastolic.md

fix(idempotency): replay a key only for the same request body

2026-10-04 10:14:22 +02:00

deploy.md

fix(deploy-webhook): accept signed requests and stop calling a bare timestamp replay protection

2026-10-25 13:52:04 +01:00

encryption-key-rotation.md

fix(auth): count a passkey as the second factor on the managed-profile acts

2026-10-17 09:56:30 +02:00

env-check.md

Correct operator runbooks against the current code

2026-08-27 12:18:34 +02:00

heap-diagnostics.md

feat(observability): break the heap sample down by V8 space

2026-10-20 20:27:24 +02:00

intake-repair.md

refactor(medications): drop the compliance rollup table that nothing reads

2026-10-20 13:01:45 +02:00

measurement-maintenance.md

fix(jobs): report the measurements bloat as whole percent, and keep finished runs finished

2026-10-22 21:43:08 +02:00

mfa-enforcement.md

docs(security): note that required-MFA prompts but does not wall the API

2026-06-27 22:23:54 +02:00

migration-0409-plaintext-location.md

docs(ops): add the recovery steps for an upgrade stopped at migration 0409

2026-10-16 03:57:46 +02:00

password-reset.md

fix(image): ship the operator scripts the runbooks run in the container

2026-09-26 15:26:03 +02:00

postgres-major-upgrade.md

docs: describe the Postgres 18 move and the versions HealthLog runs on

2026-10-25 11:18:14 +01:00

query-statistics.md

ops: load pg_stat_statements in the bundled database

2026-10-08 15:01:02 +02:00

security-recovery.md

docs(01-09): document security contract changes

2026-07-29 14:08:37 +02:00

tls-cert-pin.md

Correct operator runbooks against the current code

2026-08-27 12:18:34 +02:00