Security is a shared responsibility. Hookstride provides signed event delivery and access controls; customers remain responsible for their credentials, event sources, configured destinations and receiving applications. This page describes the current security approach and how to report a vulnerability responsibly.
1. Safeguards used by Hookstride
- Project-scoped authorization and controls for API keys and management tokens.
- Additional verification for privileged workspace and account actions.
- Signed outbound webhooks using a destination-specific secret and timestamp.
- Signature verification for specifically supported incoming providers when the optional gateway is enabled.
- Validation of destination URLs, rate limits and restricted outbound network paths where the backend's proxy isolation is configured.
- Event-level audit history, retry tracking and operational monitoring appropriate to the deployment.
These safeguards reduce risk but cannot guarantee perfect security, availability or prevention of every unauthorized act. Hookstride does not claim an independent certification, audit opinion or uptime SLA that has not been explicitly issued.
2. What customers must secure
Keep project API keys, receiving signing secrets, provider verification keys and MFA recovery codes out of public repositories, client-side applications and untrusted logs. Revoke or rotate exposed credentials promptly. Use HTTPS with certificate validation, validate raw signed webhook bodies and timestamps, authorize the event against your own tenant or user, and handle event IDs idempotently.
Do not treat Hookstride delivery as a substitute for transaction authorization, independent backups, safety controls or regulatory assessment of your application.
3. Report a vulnerability
Submit a security report through the security support form. Include the affected hostname or endpoint, a concise description, safe reproduction steps, the expected versus actual result, and a contact address we can use to follow up. Do not submit live API keys, recovery codes or another customer's personal information. You may share non-sensitive evidence after a response establishes an appropriate channel.
4. Responsible research boundaries
Do not use denial-of-service techniques, flood traffic, attack third-party infrastructure, bypass another user's authorization, exfiltrate data, or attempt to access personal information outside your own test account. Limit proof of a vulnerability to the minimum necessary and cease testing if you encounter private data. This policy does not authorize unlawful acts or guarantee immunity from legal action.
5. Disclosure and response
We aim to acknowledge actionable reports, assess their potential severity, and prioritize fixes based on impact and exploitability. Response and remediation times depend on circumstances; no guaranteed response time or monetary bug bounty is offered. Please coordinate public disclosure with us until reasonable remediation and customer protection measures are complete.
6. Security incidents and privacy
If you believe an account is compromised, revoke relevant credentials where possible and contact security support. Reports involving personal data are also handled under the Privacy Policy and Data Processing Addendum. We notify affected parties and competent authorities where required by applicable law and relevant agreements.
Questions about these policies?
Send a message through Hookstride Support. Choose billing, security or privacy as appropriate. Never include passwords, API keys, recovery codes, or personal data from an event payload in your message.