How a Node.js Bridge Connects MAX and VK Messengers to Chatwoot with Secure Bidirectional Sync

A detailed technical case study describes building a lightweight Node.js service that links the MAX messenger and VK communities to Chatwoot without scraping or using personal accounts. The bridge uses official bot APIs and community callbacks, separate API inboxes, and persistent state stored in a Docker volume to maintain conversation mappings across restarts. Security measures include webhook secret validation, deduplication of events using ring buffers, SSRF protections when handling images, and strict filtering to prevent loops or private notes from leaking externally. The implementation covers contact and conversation creation via Chatwoot Application API, image transfer for VK, and graceful recovery after partial failures. Limitations such as lack of exactly-once delivery and absence of a durable queue are acknowledged, with recommendations for production use including SQLite, retries, and structured logging. The author provides configuration examples, health checks, and a capability matrix showing current support for text and media in each direction.

HabrOctober 6, 2026Translated from Russian

Read at source

A technical walkthrough details the construction of a bidirectional bridge that integrates the MAX messenger and VK communities into Chatwoot as separate API inboxes. The solution avoids web scraping and personal account automation by relying exclusively on official bot endpoints and community callback mechanisms.

The architecture consists of a minimal Node.js service exposing four webhook routes: incoming events from MAX, VK Callback API confirmations and messages, plus protected outgoing routes triggered by Chatwoot message_created events. All traffic terminates at a reverse proxy while the container itself remains isolated on an internal Docker network.

Contacts are created with stable identifiers prefixed by channel (max: or vk:) to prevent cross-platform collisions. Conversations are then linked via source_id returned by the Chatwoot Application API, and mappings are persisted in a JSON file inside a named Docker volume to survive container restarts.

Incoming MAX messages are authenticated using the X-Max-Bot-Api-Secret header and filtered to exclude bot-generated updates. VK events undergo group_id and secret validation, with only message_new events processed. Photographs from VK are downloaded at maximum resolution and forwarded as multipart attachments.

Outbound messages from Chatwoot are filtered to ensure only genuine operator replies are relayed. MAX messages use the platform-api2 endpoint with Authorization tokens supplied via mounted secrets. VK image uploads follow the three-step photos.getMessagesUploadServer, upload, and photos.saveMessagesPhoto flow.

Deduplication relies on message IDs stored in limited ring buffers of the last 2000 events. The author notes that this provides protection against duplicate webhooks but does not guarantee exactly-once semantics. SSRF risks are mitigated by enforcing HTTPS, exact origin matching for Chatwoot URLs, MIME-type restrictions, size limits, and redirect validation.

The implementation is packaged as a minimal Alpine-based Docker image running as an unprivileged user. Production recommendations include replacing the JSON state file with a transactional database, adding a durable queue with dead-letter handling, and implementing structured logging plus rate-limit awareness.

Docker Node.js Chatwoot

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Other

Other

Mail.ru Reduces Lifetime 1TB Cloud Storage Promo to Standard 8GB Quota for Select Users

Mail.ru has begun notifying a small group of long-term Cloud Mail users that their complimentary 1TB storage, originally granted through a 2013-2014 app installation promotion, will be reduced to the standard 8GB free tier. Affected users receive personalized deadlines, with some facing storage limits starting 30 October and final deletion of excess files scheduled for 30 January 2027. The company confirmed the change impacts fewer than 0.5 percent of Cloud Mail users and stated that core free features remain available. Once the 8GB limit is exceeded, uploads, edits, and sharing are blocked while users have three months to download data or purchase additional space before files move to the trash for 14 days prior to permanent removal. This follows a similar reduction of lifetime 100GB storage performed by the service in 2024.

AntiMalwareOct 29, 2026Translated from Russian

Other

Kimi K3 Open Model Surpasses Closed AI Leaders with Million-Token Context and 896 Experts

Kimi K3 is an open-weights model that outperforms closed systems from GPT and Anthropic on several independent benchmarks. Developers achieved this by scaling three dimensions simultaneously: one million tokens of context, deeper layers, and 896 Mixture-of-Experts specialists. The team replaced the standard KV-cache with a fixed-size state matrix updated via the delta-rule, solving numerical instability by clamping the forgetting coefficient alpha between e^-5 and 1. Sequential state updates were parallelized across chips, GPUs, and multi-GPU nodes using the open-source FlashKDA kernel built on CUTLASS. Inter-layer information flow was preserved through learned pseudo-queries that selectively retrieve relevant outputs from prior blocks rather than passing full activations. Load balancing across 896 routed experts uses per-expert quantile thresholds and a distributed histogram method to guarantee fair token allocation without full sorting.

HabrOct 29, 2026Translated from Russian

Other

Innostage Completes Functional Testing of PT NGFW 1.10.3 Across 156 Criteria

Innostage has published the second part of its evaluation of PT NGFW version 1.10.3, focusing on functional capabilities rather than raw performance. The testing covered 156 individual checks grouped into categories such as basic technical features, firewalling, IDS/IPS, web filtering, malware protection, logging, routing, deployment, cryptographic controls and access management. Out of the total, 136 checks passed fully, seven passed with remarks, and 13 did not meet the predefined criteria. Key confirmed functions include high-availability clustering, centralized management via PT-MNGT, AD-based rule application, Site-to-Site VPN, TLS inspection, and Syslog integration with external security systems. Several advanced scenarios, including custom block pages, application risk classification, and centralized software distribution, were not confirmed under the test conditions. The report provides detailed protocol notes that help organizations map product capabilities against their specific infrastructure and regulatory requirements.

HabrOct 29, 2026Translated from Russian