Stéphane Tailland
0847e11713
Every webhook on this instance was answering unauthenticated requests, the stock watchlist included — it returned references and stock levels and let anyone clear entries. The A2A facade in front of these workflows enforces a bearer, but the workflows stayed reachable directly, facade bypassed. Keycloak's userinfo is the authenticator: 200 for a valid bearer in the realm, 401 otherwise, which is the auth-request contract exactly. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The file is empty.