Hookwell

Security

Our actual posture, stated plainly. SaaS-appropriate, no theater.

  • Admin API requires X-API-Key; the service logs a loud warning if the default dev key is ever used.
  • Customer portal access is scoped per token — a token sees only its own endpoints' deliveries.
  • Inbound webhooks are HMAC-verified per source (Stripe, GitHub, or shared secret) before any fan-out.
  • Signing secrets are stored server-side and never returned by any endpoint; portal tokens are shown once at mint time.
  • Outbound destinations are policy-checked (SSRF controls): HTTPS-only by default, and every delivery attempt is refused if the destination resolves to a private, link-local, loopback, or reserved address — re-checked at send time, not just at registration. Tenant API keys are stored only as SHA-256 hashes.
  • All config (API key, database path) is via environment variables; structured logs never include secrets.
  • Report a vulnerability: email us and we'll respond within 2 business days.
What we don't claim: we don't claim certifications we don't hold, we don't claim "military-grade" anything, and we don't claim a system can't fail — we claim the specific controls above and a 2-business-day response on reports.