Summary

matchesAllowedUser() in scripts/whatsapp-bridge/allowlist.js returned true when the allowlist was empty, allowing any sender to trigger the agent in bot mode. This is a medium-high severity issue: anyone who messages the bot owner's WhatsApp number could interact with their Hermes agent.

Root cause

// BEFORE (vulnerable)
if (!allowedUsers || allowedUsers.size === 0) {
    return true;  // ← empty allowlist = allow everyone
}

Fix

// AFTER (secure)
if (!allowedUsers || allowedUsers.size === 0) {
    return false;  // empty allowlist = deny unknown senders
}

Impact on self-chat mode

None. In self-chat mode the bridge already filters to fromMe=true messages before calling matchesAllowedUser. Third-party senders never reach the allowlist check in self-chat, so this change does not affect the default configuration.

What you need to do

If you are running in bot mode (WHATSAPP_MODE=bot) without WHATSAPP_ALLOWED_USERS set, you now need to configure who can use the bot:

# Allow specific users
WHATSAPP_ALLOWED_USERS=+15551234567,+15559876543

# Allow everyone (opt-in)
WHATSAPP_ALLOW_ALL_USERS=true

A clear warning is now logged at startup when bot mode is active and no allowlist is configured.

Additional improvements

• Better startup log: distinguishes self-chat vs bot mode and warns specifically when bot mode has no allowlist
• gateway/run.py: extra warning when WhatsApp is in bot mode with no allowlist configured

Testing

14 new tests in tests/test_whatsapp_allowlist_security.py covering:

• Empty/None/whitespace allowlist → deny (TestEmptyAllowlistDenies)
• Correct allowlist matching with E.164, LID, JID normalization (TestAllowlistMatchesCorrectly, TestAllowlistNormalization)
• Self-chat mode behavior is unaffected (TestSelfChatModeIsUnaffected)

Fixes #8389