supabase-webhooks-events

The code appears to implement legitimate webhook processing and contains no evident malware or intentional supply-chain attack behavior. Its primary security risks are optional signature enforcement, missing validation, privileged service-role database access, absent error handling, and a non-atomic idempotency implementation. The code should not be exposed publicly with WEBHOOK_SECRET unset, and the idempotent handler requires authentication and an atomic deduplication design.

The code is ordinary database webhook configuration rather than apparent malware. It intentionally sends database row data to specified Supabase Edge Function endpoints. The service-role key in an outgoing Authorization header and full-row serialization create meaningful confidentiality and credential-exposure risks if the destination, database setting, or function permissions are misconfigured. Use a restricted webhook secret instead of a service-role key where possible, explicitly set a safe search_path in SECURITY DEFINER functions, restrict access to pg_net response tables, and add a DELETE trigger if delete events are required.