Summary

Prepares Snare v0.4.1 with security hardening across callback authorization, self-hosted enrollment, and webhook delivery.

• rejects every unregistered callback token before alert-processing state
• requires a distinct high-entropy enrollment token for self-hosted device creation
• restricts webhook delivery to public HTTPS destinations and blocks redirects, proxy inheritance, unsafe DNS answers, and private/reserved addresses
• makes custom self-hosted enrollment failures fail closed
• registers CLI test tokens before callbacks
• updates golang.org/x/text and the Alpine runtime base
• documents enrollment-token migration and recovery for previously exposed device inventories

Verification

• go build -mod=readonly ./...
• go vet -mod=readonly ./...
• go test -mod=readonly ./... -race -count=1
• worker tests: 44 passed
• govulncheck: no called vulnerabilities
• npm audit --omit=dev: 0 vulnerabilities
• go mod verify
• docker compose config --quiet
• Alpine 3.24 container build and health smoke test
• git diff --check

Normal GitHub CI is expected to provide the final Linux and staticcheck verification before merge.

Release notes

Target release: v0.4.1.

If the self-hosted /api/devices endpoint was previously Internet-accessible, preserve the old database for investigation, initialize a fresh active database, and re-enroll approved clients using the new enrollment token.