🧹 Relay error hygiene & Telegram alert injection

[sepehrsadri]

The edge relays and the subscription worker leak internal detail in a couple of spots. Both are low-risk but worth tightening now that the code is public.

Relay error text

tools/vercel-relay/api/relay.js and tools/netlify-relay/netlify/edge-functions/relay.ts return the upstream error string to the caller on a 502 (e.g. message: err.message / detail: String(err)). Once the relay code and endpoints are public, an attacker can probe these 502s to fingerprint upstream behaviour.

• Return a generic 502 body from both relays; log the detail server-side only (mirror the main worker's top-level catch).

Telegram alert injection

The /probe/report handler interpolates attacker-influenced probe fields (country, isp, city) into the operator's Telegram alert with parse_mode: "Markdown". A holder of the scoped PROBE_TOKEN (handed to testers on untrusted networks) could inject Markdown/links into the operator's channel.

• Escape or strip Markdown metacharacters from probe fields before sendMessage, or send without parse_mode.