Guides
Security
Protect credentials, delivery endpoints, webhook integrity, and publish trust.
Provider API keys, VAPID private keys, and push endpoints are long-lived credentials. Keep them out of source control and out of unstructured logs.
The one rule
Keep provider keys and VAPID private keys in a secrets manager or environment variables.
Checklist
| Practice | Detail |
|---|---|
| SMTP TLS | requireTLS defaults to true when auth is set |
| Webhooks | Verify signatures before trusting parsed events |
| Logging | Do not log email/SMS bodies or full push endpoints |
| Push | Treat subscription endpoints and FCM tokens as delivery tokens |
| Reporting | Use private advisories — see root SECURITY.md |
Troubleshooting
Its path can contain a long-lived delivery token. Hook context keeps a short fingerprint.
Open a private GitHub Security Advisory for this repository. Do not file a public issue. Details and response targets are in SECURITY.md.