chore: general repo maintenance and docs cleanup (#3030)

Refresh README/docs for the current stack, add a security policy,
note the external-PR pause, and remove dead config and workflows.

packages/lib/server-only/webhooks/assert-webhook-url.ts

@@ -71,10 +71,17 @@ const isBypassedHost = (url: string): boolean => {
 };
 
 /**
- * Asserts that a webhook URL does not resolve to a private or loopback
- * address. Throws an AppError with WEBHOOK_INVALID_REQUEST if it does.
+ * Assert that a webhook URL does not point at a private/loopback address,
+ * checking both the literal host and its resolved DNS records. Throws an
+ * AppError with WEBHOOK_INVALID_REQUEST if it does. Hosts listed in
+ * NEXT_PRIVATE_WEBHOOK_SSRF_BYPASS_HOSTS skip all checks.
  *
- * Hosts listed in NEXT_PRIVATE_WEBHOOK_SSRF_BYPASS_HOSTS skip all checks.
+ * This is best-effort, non-exhaustive SSRF defence, NOT a complete mitigation.
+ * It does not cover DNS rebinding (the resolved address can change between this
+ * check and the actual request), obscure IP encodings, or every IPv6 form, and
+ * it fails open on lookup errors/timeouts (see the catch below). Network-level
+ * SSRF protection (firewall/egress rules, blocking internal services and cloud
+ * metadata endpoints) remains the responsibility of the deployment.
  */
 export const assertNotPrivateUrl = async (
   url: string,

packages/lib/server-only/webhooks/is-private-url.ts

@@ -3,10 +3,11 @@ import { z } from 'zod';
 const ZIpSchema = z.string().ip();
 
 /**
- * Check whether a URL points to a known private/loopback address.
+ * Synchronously check whether a URL's host is a known private/loopback address
+ * (localhost, RFC 1918, link-local, loopback, etc.), regardless of protocol.
  *
- * Performs a synchronous check against known private hostnames and IP ranges.
- * Works regardless of the URL protocol.
+ * Best-effort and non-exhaustive: unrecognised or unparseable hosts return
+ * `false` (fail open). See `assertNotPrivateUrl` for the full SSRF caveats.
  */
 export const isPrivateUrl = (url: string): boolean => {
   try {