Single read() truncates large webhook payloads

[fatihkan]

Bug Description

In webhook_server.rs:51, a single read() call is used to read the webhook request body. Large payloads (e.g., from GitHub push events with many commits) may be truncated.

Location

creedflow-desktop/src-tauri/src/services/webhook_server.rs:51

Severity

Important — Large webhook payloads silently truncated.

Steps to Fix

1. Read in a loop until EOF or Content-Length is reached
2. Set a reasonable max payload size (e.g., 1MB) to prevent DoS
3. Return 413 if payload exceeds limit

[fatihkan]

Fixed in v1.6.1 via PR #235