bleedingdeacons / link / 34411759180
92%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 19
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 95.294% (+0.05%) from 95.247%
34411759180

push

github

web-flow 
fix: say which app is calling, on every outbound request

Link sent no user-agent at all. .NET supplies none of its own, so every
request went out as whatever the platform handler defaults to — on
Android a bare `Dalvik/2.1.0 (Linux; U; Android 16; SM-S926B Build/…)`,
which names the runtime and the handset model and says nothing about the
app. Every Link handset was indistinguishable in an access log from any
other Android process on the network.

That anonymity costs more than diagnostics. An unidentified Dalvik
client polling a REST API every two minutes is the shape bot protection
scores worst, and on 2026-09-09 SiteGround's Anti-Bot AI flagged one
network's address on exactly that profile: a JavaScript challenge page
where the JSON should have been, which a native client cannot answer.
That was Hand rather than Link, but the two poll the same host in the
same shape. It is not a defence — the same host fingerprints the TLS
handshake, which no header changes — it is so the traffic is
attributable and not in the anonymous bucket to start with.

The shape is Fellowship's own, from `fellowship/src/Core/UserAgent.php`,
with the head kept in front as Hand does:

    Link/1.7.0 (Android; rest@aa-bristol.org; https://aa-bristol.org)

Sanitising is ported with it: newlines and tabs are header injection,
and a bracket or semicolon in a version string would close the comment
early and leave the contact details dangling outside it.

The Fellowship client's handler is now named rather than left to the
MAUI default, because wrapping it in the UserAgentHandler means passing
one explicitly. It is the same handler as before — that default is the
platform-native one, and it matters, since Fellowship sits behind an
edge WAF that fingerprints TLS.

1053 of 1105 relevant lines covered (95.29%)

13.11 hits per line

Jobs
ID Job ID Ran Files Coverage
1 34411759180.1 19
95.29
GitHub Action Run
Source Files on build 34411759180