Skip to content

Secure webhook delivery, identity, rotation, and metrics - #995

Merged
levoski1 merged 1 commit into
WHEELBACK:mainfrom
Mubzy2:feat/webhook-issues-963-966
Oct 21, 2026
Merged

levoski1 merged 1 commit into
WHEELBACK:mainfrom
Mubzy2:feat/webhook-issues-963-966

Conversation

@Mubzy2

@Mubzy2 Mubzy2 commented Oct 20, 2026 •

Copy link
Copy Markdown
Contributor

Summary

  • Require public HTTPS webhook destinations, reject private/reserved DNS answers, pin the validated address, and never follow redirects.
  • Support an overlap signing key during rotation and include stable event and delivery IDs on the live and retry-queue paths.
  • Expose webhook attempt, retry, outcome, duration, and dead-letter metrics; document configurable Prometheus alerts.
  • Update receiver guidance, deployment examples, and docs-sync checks.

Validation was limited to git diff --check; no builds or tests were run, as requested.

Closes #963
Closes #964
Closes #965
Closes #966

@drips-wave

drips-wave Bot commented Oct 20, 2026

Copy link
Copy Markdown

@Mubzy2 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

@levoski1
levoski1 merged commit c94b9d9 into WHEELBACK:main Oct 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

2 participants