Skip to content

fix(security): secure outgoing APIs, webhook signature checks and dynamic settings - #23

Open
ManyaGirdhar wants to merge 5 commits into
developfrom
fix/webhook-and-config
Open

fix(security): secure outgoing APIs, webhook signature checks and dynamic settings#23
ManyaGirdhar wants to merge 5 commits into
developfrom
fix/webhook-and-config

Conversation

@ManyaGirdhar

Copy link
Copy Markdown
Owner

Key Changes

  • Configuration: Loaded API keys and Base URL dynamically from the new Documenso Settings Single DocType, eliminating environment variables.
  • Security: Restricted whitelisted endpoints to POST methods, added request timeouts, and validated document write permissions.
  • Webhooks: Added constant-time HMAC signature verification.
  • Transitions: Handles contract state updates directly (Active / Rejected) via db_set to prevent workflow permission errors in the webhook lifecycle.
  • Tests: Added automated unit tests in test_api_information.py to verify signatures and completed/rejected webhook event transitions.

@ManyaGirdhar
ManyaGirdhar requested a review from Khushbu1824 June 27, 2026 13:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant