The Agent Skills Directory

[SAFE]: Implements robust signature verification for Trello webhooks using HMAC-SHA1 with the raw request body and the exact registered callback URL, protecting against request tampering and spoofing.
[SAFE]: Utilizes timing-safe comparison functions (crypto.timingSafeEqual in Node.js and hmac.compare_digest in Python) to prevent timing-based side-channel attacks during signature verification.
[SAFE]: Correctly manages the Trello-specific HEAD validation check required for webhook creation, allowing registration without requiring signatures on the bodyless HEAD request.
[SAFE]: Promotes secure secret management by instructing users to use environment variables (TRELLO_SECRET) rather than hardcoding credentials in application source code.
[SAFE]: The provided example handlers follow the principle of least privilege, restricting functionality to event logging and providing safe placeholders for future business logic.

trello-webhooks