Skip to main content

​
🛠️ Chores

  • Request logs now include Origin and Referer headers The server-side request/response logger now captures the incoming Origin and Referer headers alongside the existing Workspace-Id header, giving AppSignal traces more context for debugging cross-origin and embedded requests.
  • Data model foundations for GitHub integration Added the underlying migrations and models that back the upcoming GitHub integration for Agentic Coding apps.
    • New records for Git provider installations, repository targets, app branch targets, session events, and webhook deliveries
    • Status tracking, validation, uniqueness rules, OAuth token handling, and repository ownership details on the new models
    • Automatic cleanup of related Git records when their parent app, session, or installation is removed

​
🔒 Security

  • Clickjacking protection for embedded published apps Published Data Apps and Agentic Apps are now protected against clickjacking by enforcing a Content Security Policy frame-ancestors directive derived from each workspace’s approved embed origins.
    • Added a frame-ancestors directive to responses served through the published app proxy, limiting embedding to 'self' and the origins registered for the app’s workspace
    • Added an embed-origins lookup endpoint that returns approved origins and propagation details for a workspace, with request coalescing, caching, timeouts, and safe fallbacks
    • Origin matching now supports exact, wildcard, and pattern-based entries so admins can allow entire subdomain trees or template-style origins
    • Default CORS access is restricted to approved domains and localhost, and the embed CORS bypass is disabled by default so the allow-list is always enforced
    • Added rate limiting for unauthenticated embed-origin lookups to prevent abuse of the public lookup endpoint