ifcurl/.beads
Bruno Postle d076196bac service.py: SSRF protection — reject local transport, add --allowed-hosts
The preview endpoint is co-hosted with a specific Forgejo instance, so it
should only be allowed to fetch from that host.

- Local file transport (ifc:///path) is always rejected with 403 — the service
  must not read from the server's own filesystem
- New --allowed-hosts CLI option for `ifcurl serve` takes a comma-separated
  list of permitted git hostnames (e.g. git.example.com or localhost:3000);
  any unlisted host is rejected with 403
- Defense-in-depth: literal private/loopback/link-local IP addresses are
  blocked even without an allowlist (169.254.x.x, 127.x, RFC1918, etc.)
- README and forgejo/README.md updated to include --allowed-hosts in the
  standard deployment invocation

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-24 08:26:37 +01:00
..
hooks bd init: initialize beads issue tracking 2026-04-23 06:41:01 +01:00
.gitignore bd init: initialize beads issue tracking 2026-04-23 06:41:01 +01:00
config.yaml bd init: initialize beads issue tracking 2026-04-23 06:41:01 +01:00
issues.jsonl service.py: SSRF protection — reject local transport, add --allowed-hosts 2026-04-24 08:26:37 +01:00
metadata.json bd init: initialize beads issue tracking 2026-04-23 06:41:01 +01:00
README.md bd init: initialize beads issue tracking 2026-04-23 06:41:01 +01:00

Beads - AI-Native Issue Tracking

Welcome to Beads! This repository uses Beads for issue tracking - a modern, AI-native tool designed to live directly in your codebase alongside your code.

What is Beads?

Beads is issue tracking that lives in your repo, making it perfect for AI coding agents and developers who want their issues close to their code. No web UI required - everything works through the CLI and integrates seamlessly with git.

Learn more: github.com/steveyegge/beads

Quick Start

Essential Commands

# Create new issues
bd create "Add user authentication"

# View all issues
bd list

# View issue details
bd show <issue-id>

# Update issue status
bd update <issue-id> --claim
bd update <issue-id> --status done

# Sync with Dolt remote
bd dolt push

Working with Issues

Issues in Beads are:

  • Git-native: Stored in Dolt database with version control and branching
  • AI-friendly: CLI-first design works perfectly with AI coding agents
  • Branch-aware: Issues can follow your branch workflow
  • Always in sync: Auto-syncs with your commits

Why Beads?

AI-Native Design

  • Built specifically for AI-assisted development workflows
  • CLI-first interface works seamlessly with AI coding agents
  • No context switching to web UIs

🚀 Developer Focused

  • Issues live in your repo, right next to your code
  • Works offline, syncs when you push
  • Fast, lightweight, and stays out of your way

🔧 Git Integration

  • Automatic sync with git commits
  • Branch-aware issue tracking
  • Dolt-native three-way merge resolution

Get Started with Beads

Try Beads in your own projects:

# Install Beads
curl -sSL https://raw.githubusercontent.com/steveyegge/beads/main/scripts/install.sh | bash

# Initialize in your repo
bd init

# Create your first issue
bd create "Try out Beads"

Learn More


Beads: Issue tracking that moves at the speed of thought