stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity
Files
deb82b4f03bbabf1067f28e3c7aa3a5c1509b583
git.stella-ops.org/docs/modules/notify/security/webhook-ack-hardening.md
StellaOps Bot deb82b4f03 docs consolidation work
2025-12-25 10:54:10 +02:00

444 B
Raw Blame History

Webhook and ack security (NR6)

  • Webhooks must use HMAC-SHA256 with per-tenant rotating secrets or mTLS/DPoP. hmac_id maps to secret material.
  • Ack URLs carry signed tokens (nonce, audience, tenant_id, delivery_id, expires_at) and are single-use. Reject replay or expired tokens.
  • Enforce allowlists for domains and paths per tenant; deny wildcards.
  • Capture failures in observability pipeline and DLQ with redrive after investigation.