Summary

• require a webhook auth secret before starting Feishu/Lark webhook mode on network-accessible bind hosts such as 0.0.0.0
• validate configured FEISHU_VERIFICATION_TOKEN before responding to url_verification challenges
• document the fail-closed requirement for exposed Feishu webhooks

Security impact

This hardens the remote Feishu webhook attack surface. Before this change, a publicly exposed webhook listener could be started without FEISHU_VERIFICATION_TOKEN or FEISHU_ENCRYPT_KEY, and URL verification challenges were reflected before token validation. A remote attacker who can reach such a listener could interact with the unauthenticated verification path and, when paired with permissive deployment choices, drive unauthenticated webhook processing.

Test Plan

• python -m pytest -n 0 tests/gateway/test_feishu.py -q