Conversation
hotfix: remove webhook URL
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0cfaaed353
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| async scheduled(controller: ScheduledController, env: Env, ctx: ExecutionContext) { | ||
| const webhookUrl = | ||
| 'https://discord.com/api/webhooks/1441344649863364608/vzOVqSEeNtjavKfq9MJaNoCB402dd_2W6J3BBr2nHFRngXEPaUm3r0IsvSs41ZIrSahz'; | ||
| const webhookUrl = ''; |
There was a problem hiding this comment.
When the scheduled worker runs, webhookUrl is now an empty string. In Cloudflare Workers, fetch requires an absolute URL, so fetch(webhookUrl, …) throws TypeError: Invalid URL and the scheduled task aborts before sending any reminders. If the goal is to remove the hard‑coded secret, this should be read from env (or the fetch should be skipped when the URL is empty) to avoid runtime failure.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Pull request overview
This pull request removes hardcoded Discord webhook URLs from the codebase to address a security vulnerability where sensitive credentials were exposed in source code. The PR also includes formatting improvements to align with code style conventions.
Changes:
- Removed hardcoded Discord webhook URLs from the notification scheduler and frontend reminder component
- Applied code formatting updates (quote style changes from double to single quotes, improved indentation)
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| products/notify/src/index.ts | Replaced hardcoded Discord webhook URLs with empty strings and reformatted historyData array structure |
| products/frontend/src/routes/Root/components/ReminderTest/ReminderTest.tsx | Replaced hardcoded Discord webhook URL with empty string and applied consistent formatting (single quotes, improved type formatting) |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| async scheduled(controller: ScheduledController, env: Env, ctx: ExecutionContext) { | ||
| const webhookUrl = | ||
| 'https://discord.com/api/webhooks/1441344649863364608/vzOVqSEeNtjavKfq9MJaNoCB402dd_2W6J3BBr2nHFRngXEPaUm3r0IsvSs41ZIrSahz'; | ||
| const webhookUrl = ''; |
There was a problem hiding this comment.
Setting webhook URLs to empty strings will cause the fetch calls to fail. The code attempts to fetch an invalid URL (''), which will throw an error at runtime. Consider using environment variables to store webhook URLs securely (e.g., add WEBHOOK_URL to the Env interface and configure it in wrangler.jsonc), or add a check to skip the fetch call if the URL is not configured.
|
|
||
| const ReminderTest: FC<Props> = (props) => { | ||
| const discordWebhookUrl = "https://discord.com/api/webhooks/1430405385671671858/EZZlF3vrhVw-zwhBg9OVVuINsOJHSc-NneYRfVKzR-V32Ng76lYLcByOnVKCkNuVrIfG"; | ||
| const discordWebhookUrl = ''; |
There was a problem hiding this comment.
Setting webhook URL to empty string will cause the fetch call to fail. The code attempts to fetch an invalid URL (''), which will throw an error when the button is clicked. Consider using environment variables to store the webhook URL securely (e.g., import.meta.env.VITE_DISCORD_WEBHOOK_URL), or add a check to disable the button or skip the fetch if the URL is not configured.
| from: "ひろと", | ||
| amount: 2000 | ||
| }]; | ||
| const webhookUrlTest = ''; |
There was a problem hiding this comment.
Setting webhookUrlTest to empty string will cause the fetch call to fail. The code attempts to fetch an invalid URL (''), which will throw an error at runtime. Consider using environment variables to store webhook URLs securely (e.g., add WEBHOOK_URL_TEST to the Env interface and configure it in wrangler.jsonc), or add a check to skip the fetch call if the URL is not configured.
No description provided.