luna/marketingskills
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: security hardening — move meta-ads to header auth, encode URLs

Browse Source 
Critical:
- meta-ads: move access_token from URL query string to Authorization
  header to prevent credential leakage in server logs and referrers

Medium (URL encoding):
- g2: encode state and date filter values
- trustpilot: use URLSearchParams for reviews list params
- typeform: encode response IDs in delete endpoint
- demio: encode event type filter
- lemlist: encode email addresses in URL path segments

Docs:
- Fix 6 missing env vars in CLI README auth table
- Fix .gitignore typo (extra space in .DS_Store pattern)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Corey Haines
2026-02-17 22:39:16 -08:00
parent 47b4571ca2
commit c1be574c8b
8 changed files with 31 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/clis/lemlist.js
+5 -5
View File
@@ -112,7 +112,7 @@ async function main() {
case 'get': {
if (!args['campaign-id']) { result = { error: '--campaign-id required' }; break }
if (!args.email) { result = { error: '--email required' }; break }
result = await api('GET', `/campaigns/${args['campaign-id']}/leads/${args.email}`)
result = await api('GET', `/campaigns/${args['campaign-id']}/leads/${encodeURIComponent(args.email)}`)
break
}
case 'add': {
@@ -122,13 +122,13 @@ async function main() {
if (args['first-name']) body.firstName = args['first-name']
if (args['last-name']) body.lastName = args['last-name']
if (args.company) body.companyName = args.company
result = await api('POST', `/campaigns/${args['campaign-id']}/leads/${args.email}`, body)
result = await api('POST', `/campaigns/${args['campaign-id']}/leads/${encodeURIComponent(args.email)}`, body)
break
}
case 'delete': {
if (!args['campaign-id']) { result = { error: '--campaign-id required' }; break }
if (!args.email) { result = { error: '--email required' }; break }
result = await api('DELETE', `/campaigns/${args['campaign-id']}/leads/${args.email}`)
result = await api('DELETE', `/campaigns/${args['campaign-id']}/leads/${encodeURIComponent(args.email)}`)
break
}
default:
@@ -147,12 +147,12 @@ async function main() {
}
case 'add': {
if (!args.email) { result = { error: '--email required' }; break }
result = await api('POST', `/unsubscribes/${args.email}`)
result = await api('POST', `/unsubscribes/${encodeURIComponent(args.email)}`)
break
}
case 'delete': {
if (!args.email) { result = { error: '--email required' }; break }
result = await api('DELETE', `/unsubscribes/${args.email}`)
result = await api('DELETE', `/unsubscribes/${encodeURIComponent(args.email)}`)
break
}
default: