exact-online-webhooks
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements security best practices for webhook handling, including:
- Recommending HMAC-SHA256 verification of the
HashCodebody field against the raw request content to prevent payload tampering and unauthorized requests. - Utilizing timing-safe comparison functions (
crypto.timingSafeEqualin Node.js andhmac.compare_digestin Python) to mitigate timing attacks. - Providing clear instructions for secure secret management via environment variables.
- Using legitimate developer tools (such as
hookdeck-cli) and referencing official documentation from Exact Online. - Warning users about the risks of re-serializing JSON, which is a common pitfall that breaks signature verification.
Audit Metadata