Security and operational limits

HTTPS and public Destination requirements

Destination URLs must be public HTTPS URLs without credentials or custom ports. DeadHook rejects:

• HTTP and non-HTTPS schemes;
• loopback, private, link-local, multicast, reserved, documentation, metadata, and unspecified addresses;
• IP-literal hosts;
• redirects (not followed);
• hostnames that resolve to a blocked range.

A Destination that fails these requirements is not retried forever.

Signatures and secret handling

• Source secrets authenticate inbound provider requests.
• Destination signing secrets authenticate outbound DeadHook requests.
• DeadHook-issued secrets are shown once. Store them in a secret manager; never in frontend bundles, public repositories, screenshots, or logs.
• Source rotation has a 24-hour overlap; verify both current and previous signatures during rotation.
• Always verify over raw request bytes and compare signatures in constant time.

At-least-once delivery

Delivery is at least once. Duplicates can occur after an ambiguous timeout, a delivery interruption, or a manual replay. Consumers must deduplicate using webhook-id plus a business key and must make side effects idempotent.

DeadHook does not promise exactly-once processing, ordering across Deliveries, or eventual success.

Payload privacy

Raw payloads and captured responses are Organization-private production data. Access requires an authorized role (Developer or above for payloads). Do not put secrets in payloads that you would not want stored. Retention is bounded; export what you need for compliance.

Response capture

Capture is opt-in, bounded, and expires. It is a debugging aid, not an audit archive. Viewers cannot read captured responses. Treat snippets as sensitive.

Retry and timeout limits

• 8 attempts by default;
• 24-hour retry age ceiling;
• 1–30 second Destination timeout (default 10 seconds);
• no redirect following;
• Delivery stops and expiry are terminal for automatic work.

These limits bound retry growth and abuse. They are not a guarantee of eventual success.

Rate and quota limits

• Ingestion is rate-limited per Source/Organization and bounded by monthly accepted Event quota.
• Plan limits also cap Sources, Destinations, and members.
• Request-rate limiting returns 429 rate_limited with Retry-After; honor it.
• Monthly accepted-Event quota exhaustion returns 409 plan_limit_reached and is not transient.
• Accepted Event quotas count per Organization, not per Project.

Access and data isolation

Your Organization's data is isolated, and access is controlled by your membership role. Protect invitation links and do not share dashboard credentials. A resource reference from another Organization is not visible through the dashboard.