Security
What we store, what we refuse to store, and what stands between a published event and somebody else's network.
In short
- Credentials are stored as hashes; the ones we must be able to use are encrypted, not hashed.
- Outbound delivery is guarded twice against reaching private networks — in code and at the network layer.
- Every tenant-scoped query carries the project; a resource of another tenant answers "not found", never "forbidden".
- Data is hosted in the EU, in Frankfurt.
What is stored
| Item | How it is stored | Why |
|---|---|---|
| Account password | Hashed with a salt and a real work factor | Human-chosen, therefore low entropy — the cost parameter is the defence, and it travels inside the stored value so it can be raised later |
| API key | Hashed, plus the visible prefix | The prefix identifies a key in a log without revealing it. The token itself is never stored, which is why a lost key is replaced rather than recovered |
| Browser session | Hashed | The token is 32 bytes from a CSPRNG; there is no dictionary to run against it, so the hash is a lookup, not a work factor |
| Sign-in code | Hashed with a server-side key | Six digits is low entropy, so the stored value is keyed — a database copy alone is not a list of working codes |
| Password reset link | Hashed | Single use, short-lived, and invalidated when a newer one is requested |
| Endpoint signing secret | Encrypted | It has to be recoverable to sign with, so it is encrypted rather than hashed |
| Audit log parameters | Hashed | An audit log should not become a second copy of what it audits |
Delivery safety
A webhook service is, by construction, a machine that makes HTTP requests to addresses supplied by its users. That is the definition of a server-side request forgery risk, so it is treated as the centre of the product rather than a checkbox.
- Resolve, validate, then pin. The destination is resolved, every returned address is checked against the special-purpose ranges, and the connection is made to the exact address that was validated — so a name cannot resolve to something else between the check and the connection.
- A second, independent layer. The network itself refuses egress from the service account to private ranges and cloud metadata addresses, so a mistake in the first layer is not sufficient.
- Redirects are never followed. A destination that answers with a redirect does not get to choose a second address.
- HTTPS on live projects. Plain HTTP is allowed only on test projects.
Tenant isolation
Every tenant-scoped query takes the project id and puts it in the where clause; there is no administrative path around it. A resource belonging to another tenant is reported as not found rather than forbidden, so probing cannot be used to learn what exists. Identifiers are unguessable rather than sequential.
What enters the pipeline
- Payloads are checked structurally — prototype-pollution keys, absurd nesting, control characters and non-JSON content types are refused. The check never inspects the meaning of your data.
- Custom headers that would rewrite the request itself are rejected, as is header injection.
- Inbound sources verify the provider's own signature over the raw bytes before anything is accepted.
Accounts
- Sign-in codes expire quickly, are single use, allow a small number of attempts, and are bound to the tab that requested them.
- A password reset link is single use and short-lived, ends every existing session, and the owner is emailed that the password changed.
- Sign-in answers identically whether the address is unknown or the password is wrong.
- Roles are ranks — viewer, developer, admin, owner — expanded to permissions per request, so a demotion takes effect everywhere.
Where it runs
Frankfurt, in the EU. There is no other region to select and no premium attached to this one. Deletion of a project deletes its data.
Reporting something. If you believe you have found a vulnerability, write to security@hookget.com with enough detail to reproduce it. We will confirm receipt and keep you informed. Please do not test against other tenants' data.
What we do not claim. There is no SOC 2 report, no HIPAA BAA and no PCI attestation today. If your procurement requires one, say so early and we will tell you honestly where that stands rather than start a process behind your back.