- Add DNS resolution validation to block webhooks to internal IPs - Validate hostname resolves before accepting webhook URL - Block metadata endpoints (AWS, GCP, Azure) - Block localhost, private IPs, and reserved ranges - Add context timeout for DNS lookups (2s)
- Add SQLite-backed audit logger for persistent audit trails - Implement cryptographic signing for tamper detection - Add audit log export functionality - Add webhook notifications for audit events