Skip to content

VoucherBot v1.0.2

Choose a tag to compare

View all tags
@Devathmaj Devathmaj released this 12 Aug 12:44
· 50 commits to main since this release
v1.0.2
585acae
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v1.0.2 — Security Hardening

Security and hygiene patch release: closes HIGH-severity findings from the codebase audit, tightens the exposed API surface, and removes dead code.

Security

  • SHA-1 replaced with SHA-256 (H-3) — all four collectors now hash with hashlib.sha256; behavior-neutral since dedup is driven by the pipeline's independent SHA-256 identity_hash
  • Secrets redacted from log output (H-4) — new redact_secrets structlog processor masks sensitive keys and secret-shaped fragments (API keys, Bearer tokens, URL credentials, sensitive query params) across all log sites, including nested config dicts and exception strings
  • Rate limiting on /health (H-5) — minimal in-memory sliding-window limiter (default 60 req/min/IP, configurable via HEALTH_RATE_LIMIT_PER_MINUTE, 0 disables) returning 429 + Retry-After
  • API surface reduced to /health only — /ready, /sources, /posts, and /alerts endpoints removed along with their routers, shrinking the unauthenticated attack surface
  • CSS selector validation (H-1) — bootstrap now logs a warning for malformed selectors in source config (log-only, never rejects)

Maintenance

  • Removed vestigial NormalizedPost.external_id field and its now-unused hashlib imports across all collectors
  • Removed unused apscheduler dependency (scheduling is a custom asyncio loop)
  • Applied ruff format fixes

Testing

  • Full suite: 167 passed, 15 skipped
  • ruff check, ruff format --check, and mypy voucherbot tests all clean
  • New tests for log redaction and health rate-limiting (429 + disabled paths)

Full Changelog: v1.0.1...v1.0.2

Assets 2
Loading