krz/domain-dig

an ios app for DNS & SSL analysis

clone: git clone https://gitbay.org/krz/domain-dig.git

77a42a8b4f3dd89e631f8246bdea3e95f83bac6a

unsigned

author: Christian Cleberg <hello@cleberg.net> · 2026-07-20T16:56:37Z

fix: harden webhook transport and gate debug logging

Require HTTPS for outbound integration webhooks. Webhook URLs are
themselves secrets (Slack in particular), so an http:// endpoint leaked
both the URL and the alert payload in cleartext.

Disable DomainDebugLog in release builds. Every message used
privacy: .public, which opted out of OSLog redaction and wrote looked-up
domains to the unified log in shipped builds.

 DomainDig/DomainDig/DomainDebugLog.swift | 4 ++++
 DomainDig/IntegrationService.swift       | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/DomainDig/DomainDig/DomainDebugLog.swift b/DomainDig/DomainDig/DomainDebugLog.swift
index 12a6cc5..0898e4a 100644
--- a/DomainDig/DomainDig/DomainDebugLog.swift
+++ b/DomainDig/DomainDig/DomainDebugLog.swift
@@ -2,7 +2,11 @@ import Foundation
 import os
 
 enum DomainDebugLog {
+#if DEBUG
     static let enabled = true
+#else
+    static let enabled = false
+#endif
     private static let logger = Logger(subsystem: "co.zerolabs.domain-dig", category: "Debug")
 
     static func debug(_ message: String) {
diff --git a/DomainDig/IntegrationService.swift b/DomainDig/IntegrationService.swift
index dba8034..9948441 100644
--- a/DomainDig/IntegrationService.swift
+++ b/DomainDig/IntegrationService.swift
@@ -555,7 +555,7 @@ private enum HTTPIntegrationClient {
         headers: [String: String],
         timeoutSeconds: Double
     ) async throws {
-        guard let url = URL(string: urlString) else {
+        guard let url = URL(string: urlString), url.scheme?.lowercased() == "https" else {
             throw IntegrationError.invalidURL
         }