[sh1pt-actions-fleet]

Adds a group.call card to SMSHub Settings. CoinPay authenticates the matching account, SMSHub creates an internal API key, and the callback provisions it directly to group.call over HTTPS. The key is never returned to the browser. Disconnect removes the link and revokes the SMSHub key.

Validation: bun run test, bun run typecheck, bun run lint, and bun run build pass.

[github-actions]

ThreatCrush Security Scan

14 finding(s)

HIGH/CRITICAL: 2 | MEDIUM: 4 | LOW: 8

Severity	Rule	Location
HIGH	sh-unquoted-expansion-destructive	public/install.sh:67
HIGH	sh-remote-script-execution	public/install.sh:89
MEDIUM	sh-remote-script-execution	public/install.sh:133
MEDIUM	js-open-redirect	src/app/numbers/page.tsx:180
MEDIUM	js-open-redirect	src/components/inbox-client.tsx:35
MEDIUM	js-unescaped-html-sink	src/components/pit-footer.tsx:17
LOW	secret-generic-credential	src/lib/providers/__tests__/twilio.test.ts:24
LOW	secret-generic-credential	src/lib/providers/__tests__/twilio.test.ts:46
LOW	secret-generic-credential	src/lib/providers/__tests__/twilio.test.ts:60
LOW	secret-generic-credential	src/lib/providers/__tests__/twilio.test.ts:78
LOW	secret-generic-credential	src/lib/vault/__tests__/vault.test.ts:117
LOW	secret-generic-credential	src/lib/webhooks/__tests__/supabase-store.test.ts:11
LOW	secret-generic-credential	supabase/config.toml:287
LOW	secret-generic-credential	supabase/config.toml:319

Snippets are redacted; ThreatCrush never prints matched credential material.