Skip to content

v0.1.2 — email channel approval security fix

Choose a tag to compare

@danielstpaul danielstpaul released this 16 Jul 09:23

Security fix (email channel scaffold). The generated Agent::Channels::Email#deliver_approval mailed the approval link to email["from"] — the address that started the session, which for a support agent is the customer, letting them approve their own gated request. Approvals now route to a configured operator (SILAS_APPROVER_EMAIL) and fail closed if unset. The Slack scaffold was unaffected (its card posts to the team channel/thread, not the initiator).

gem install silas · 0.1.2