{{ message }}
fix(bug-handler): fail closed when BUG_ALLOWED_SENDERS is unset - #2525
Merged
Conversation
The sender allowlist previously failed open: an unset BUG_ALLOWED_SENDERS let any sender emailing bug@ open GitHub issues in the configured repo. SPF only authenticates the sending domain, not authorization, and the worker's intended source is Sentry alert mail only. parseConfig now resolves BUG_ALLOWED_SENDERS to: - unset -> built-in Sentry-only default (@sentry.io, notifications.sentry.io) - "" (explicit empty) -> reject every sender - "*" -> explicit opt-out, allow every sender - comma list -> parsed allowlist, unchanged Rejected senders are now logged with sender + subject at warn level so operators notice dropped mail (misconfiguration, or Sentry changing its sending domain). Documented in docs/knowledge/bug-handler-email-worker.md. Co-Authored-By: duyetbot <bot@duyet.net>
duyet
enabled auto-merge (squash)
July 10, 2026 00:58
github-actions
Bot
added
the
documentation
Contributor
☁️ Cloudflare Preview Deployment
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
isSenderAllowedinapps/bug-handler/src/config.tsfailed open: an unsetBUG_ALLOWED_SENDERS(the default, and current production state — it's notset anywhere in
wrangler.tomlor CI) let any sender emailingbug@chmonitor.devcreate GitHub issues in the configured repo. SPF onlyauthenticates the sending domain, not authorization, and the worker's
intended source is Sentry alert mail only.
parseConfignow resolvesBUG_ALLOWED_SENDERSto:['@sentry.io', '@notifications.sentry.io']""(explicit empty)[]"*"['*']isSenderAllowed([])now rejects (previously allowed) — the"*"sentinelis the new explicit "allow all" signal. Rejected senders are logged with
sender + subject at
warnlevel before the message is dropped, so operatorsnotice misconfiguration or a Sentry sending-domain change.
Why
Issue spam / content injection into the tracker (which coding agents read)
via any sender who discovers the address — see #2502.
Files changed
apps/bug-handler/src/config.ts— new default/sentinel constants, updatedparseConfigandisSenderAllowedsemanticsapps/bug-handler/src/index.ts— warn-log now includes the subject;Envdoc comment updated
apps/bug-handler/src/config.test.ts,apps/bug-handler/src/index.test.ts— extended for the unset/""/"*"/explicit-list cases + the warn-log
assertion;
FULL_ENV'sBUG_ALLOWED_SENDERSmoved from''(previously"allow all") to the explicit
'*'opt-out so unrelated tests keep theiroriginal "no sender restriction" intent
docs/knowledge/bug-handler-email-worker.md— documents the three casesand the warn-log signal; bumped
updated:dateVerification
node_modules(this worktree hasnone) plus a direct link to bun's own
postal-mimecache entry(
~/.bun/install/cache, no install command run) sobun testcouldresolve the worker's one runtime dependency:
bun test src/— 91 pass, 0 fail (up from 82 baseline + 9 new)tsc --noEmit— cleansenders):
BUG_ALLOWED_SENDERSis not set inwrangler.tomlor any CIworkflow, and the repo has zero issues carrying the bot's
bug+sentry+automatedlabels — the worker has not created any issuein production yet, Sentry or otherwise, so the default change drops no
real mail.
Closes #2502
https://claude.ai/code/session_018h2h5erikMP3aM7p8YdXfY