fix: unauthenticated Gmail/Calendar webhooks, OAuth identity spoof, and avatar SSRF - #49

Closed

Gmin2 wants to merge 2 commits into

10xapp:mainfrom

Gmin2:inbound-trust-bug

Commits on Apr 28, 2026

fix: verify pub/sub push tokens on gmail and calendar webhooks, harden microsoft validation
Gmin2
committed
673e06d
fix: re-derive oauth identity from access token and block avatar ssrf
Gmin2
committed
dbaa67b