# Security-gate report

## Scope (files reviewed)
- `endpoints.ts` — target

## endpoints.ts
**Oracle (complete-mediation):** SILENT

**LLM leg (v2@sonnet/MED, 3-roll union):**
- [high] `GET /:id/deliveries/:did` ignores the `:id` path parameter — intra-tenant IDOR  _(found by 3/3 rolls)_
- [high] Missing SSRF guard on `PATCH /:id` — stored URL bypasses all IP-block rules  _(found by 1/3 rolls)_
- [high] PATCH endpoint stores arbitrary URLs without SSRF validation — bypass enables internal URL persistence  _(found by 1/3 rolls)_
- [high] Retry endpoint has no idempotency guard — concurrent retries produce duplicate outbound dispatches  _(found by 1/3 rolls)_
- [high] SSRF bypass via PATCH — `assertSafeWebhookUrl` never called on URL update  _(found by 1/3 rolls)_
- [medium] `JSON.parse(endpointRaw.secretEncrypted)` throws uncaught on malformed or null DB value  _(found by 3/3 rolls)_
- [medium] Outbound fetch precedes DB record insertion in both retry and test paths — Worker eviction leaves delivery unrecorded  _(found by 2/3 rolls)_
- [medium] `POST /:id/deliveries/:did/retry` has no status guard — already-delivered events re-dispatched unconditionally  _(found by 1/3 rolls)_
- [medium] `assertSafeWebhookUrl` does not block non-dotted-decimal or octal IPv4 representations  _(found by 1/3 rolls)_
- [medium] Rotate-secret has a TOCTOU race — one concurrent caller receives a non-functional plaintext secret  _(found by 1/3 rolls)_
- [medium] No rate limiting on test dispatch or manual retry — authenticated HTTP amplification / DoS proxy  _(found by 1/3 rolls)_
- [medium] No timeout on outbound `fetch` — Worker held indefinitely by slow target  _(found by 1/3 rolls)_
- [low] Role check for `rotate-secret` is case-sensitive only for two variants and casts session to `any`-shaped object  _(found by 1/3 rolls)_
- [low] Test deliveries can be retried as real deliveries — no status guard on retry  _(found by 1/3 rolls)_
- [low] Owner role check silently excludes title-cased `'Owner'` — unverified cross-file dependency  _(found by 1/3 rolls)_
- [low] Fragile role comparison using dual-case strings with an unsafe type cast  _(found by 1/3 rolls)_
- [low] DNS rebinding / TOCTOU window in SSRF guard  _(found by 1/3 rolls)_