d-u.net/fedi-signup-bot
Watch
2
0
Fork
You've already forked fedi-signup-bot
 0
Code Releases 25 Packages 1 Activity Actions
25 releases 34 tags
  • v2.6.0 abf20aa6a0

    v2.6.0 Stable

    david.gabriel released this 2026-09-09 14:27:16 +00:00 | 11 commits to main since this release

    Changes

    • Untrusted signup data is sanitized before it is displayed. Values that
      come from a new account — its username, email domain, and IP address — are
      cleaned before they appear in moderation messages and the web UI, so an
      applicant can no longer use them to change what a moderator sees.
    • Email addresses are no longer written to the logs in plain text. A full
      address is recorded only when PII logging is explicitly switched on;
      otherwise a short fingerprint is used. This now holds for every log line, not
      just most of them.
    • Pending signups survive temporary Mastodon errors. If the bot's
      background check of a pending account hits a one-off failure — a timeout, a
      dropped connection, or a maintenance window — it retries instead of assuming
      the account was rejected, so a legitimate signup is not silently removed and
      moderators are not shown a false reason.
    • The external email-reputation lookup is hardened. The address sent to the
      UserCheck service is validated and encoded before the request is built, the
      same way the IP lookup already works.
    Downloads