Remove/disable dev-only crash reporting webhook before production release #14

New issue

Open

opened 2026-07-23 18:29:03 +00:00 by mohlec · 1 comment

mohlec commented

2026-07-23 18:29:03 +00:00

Owner

Added 2026-07-09 (commit aeed7f68f) as a stopgap since no 3rd-party crash reporting (Sentry etc.) is wired up. Posts JS errors and native exceptions (Android/iOS) to a private Mattermost incoming webhook channel.

Before App Store / Play Store submission:

Disable or remove the feature entirely (app/utils/crash_report.ts, native handlers in MainApplication.kt / AppDelegate.mm, Settings toggle in advanced.tsx)
Rotate/delete the webhook itself (https://chat.ncwcom.com/hooks/zgbotadhbintjps66d7erbqgte) - it is currently embedded client-side in assets/base/config.json (CrashReportWebhookUrl), extractable from the compiled app

See PRD slash-deploy/docs/PRD-slash-platform.md Phase 5 Android section (commit 8312d16) for full context.

Added 2026-07-09 (commit `aeed7f68f`) as a stopgap since no 3rd-party crash reporting (Sentry etc.) is wired up. Posts JS errors and native exceptions (Android/iOS) to a private Mattermost incoming webhook channel. **Before App Store / Play Store submission:** - Disable or remove the feature entirely (`app/utils/crash_report.ts`, native handlers in `MainApplication.kt` / `AppDelegate.mm`, Settings toggle in `advanced.tsx`) - Rotate/delete the webhook itself (`https://chat.ncwcom.com/hooks/zgbotadhbintjps66d7erbqgte`) - it is currently embedded client-side in `assets/base/config.json` (`CrashReportWebhookUrl`), extractable from the compiled app See PRD `slash-deploy/docs/PRD-slash-platform.md` Phase 5 Android section (commit `8312d16`) for full context.

mohlec commented

2026-08-04 17:40:07 +00:00

Author

Owner

Deferred - not a beta blocker.

Decision: in-app crash reporting stays enabled for the duration of the internal beta.

Rationale: the embedded-webhook exposure only matters against an untrusted user population, and there isn't one - the entire current user base is internal staff. Meanwhile the crash trail is actively useful right now, since ongoing beta use is expected to surface new issues, and this is currently the only diagnostic trail the app has.

This remains a release gate, not backlog. Act on it at the first release aimed at anyone outside the organization:

public app store listing (either platform)
the customer-facing role (Phase 8)
any external contractor install

At that point: disable or remove the feature entirely, and rotate/delete the incoming webhook - it ships client-side in assets/base/config.json and is extractable from the compiled app.

**Deferred - not a beta blocker.** Decision: in-app crash reporting stays enabled for the duration of the internal beta. Rationale: the embedded-webhook exposure only matters against an untrusted user population, and there isn't one - the entire current user base is internal staff. Meanwhile the crash trail is actively useful right now, since ongoing beta use is expected to surface new issues, and this is currently the only diagnostic trail the app has. This remains a **release gate**, not backlog. Act on it at the first release aimed at anyone outside the organization: - public app store listing (either platform) - the customer-facing role (Phase 8) - any external contractor install At that point: disable or remove the feature entirely, and rotate/delete the incoming webhook - it ships client-side in `assets/base/config.json` and is extractable from the compiled app.

mohlec referenced this issue

2026-09-01 18:23:53 +00:00

Move NTFY_SERVER out of source into BuildConfig (hostname in a public repo) #23

mohlec referenced this issue

2026-09-01 18:23:53 +00:00

ci: fail the build on new internal references in this public repo #24

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

slash/slash-mobile#14

No description provided.

Rows
Columns