chookg-ComfyUI-ChickTools/docs/DOMAIN_REQUESTS.md

Requesting a callback domain

The current host allowlist contains only notify.bro3.net. This is a repository policy, not a claim of platform approval. URLs remain blank by default; supplying a host does not provision a receiver or grant access to that service.

1. Open a domain request or a PR. Provide the exact hostname, the intended notification use, how you can demonstrate control of the domain, and how received data is handled. Use example paths without credentials; keep private tokens out of issues and workflows.
2. The repository maintainer reviews the domain and endpoint behavior. A domain should resolve to public addresses and receive callbacks without redirects. Wildcards, broad parent domains and uncontrolled forwarding destinations are outside this policy.
3. Accepted additions update ALLOWED_CALLBACK_HOSTS in utils/callback_policy.py, the node help, documentation and security tests. There is no automatic discovery, remote list download or workflow override.
4. The maintainer submits the changed policy and source revision to the relevant upstream/platform reviewers. ComfyUI-Manager catalog review and RunningHub installation review are separate processes. Each platform decides whether and when to accept and install the updated version; a merged repository PR alone does not authorize additional cloud callback destinations.

Existing installations keep the policy bundled with their installed revision. Normal users can edit their endpoint path, task id and msg, but cannot expand the accepted host list through a workflow.