Skip to content

fix!: harden and deduplicate webhook deliveries - #24

Closed
sodle-splunk wants to merge 3 commits into
mainfrom
sodle/authenticate-webhooks
Closed

sodle-splunk wants to merge 3 commits into
mainfrom
sodle/authenticate-webhooks

Conversation

@sodle-splunk

@sodle-splunk sodle-splunk commented Aug 5, 2026 •

Copy link
Copy Markdown
Contributor

Bug Fixes

  • PAPP-38195 / PSAAS-31259: Default the webhook network allowlist to empty so operators must explicitly authorize delivery addresses.
  • Deduplicate repeated deliveries using asset-scoped platform source identifiers.
  • Prevent webhook-created artifacts from automatically running playbooks.
  • Follow-up to [PAPP-38195] Harden GreyNoise widget and CVE handling #22.

Manual Documentation

  • I have verified that manual documentation has been updated where appropriate

Other information

  • GreyNoise public documentation does not define request-signature validation, so this connector does not assume a proprietary signature header or shared-secret contract.
  • Breaking change: existing webhook assets must configure an explicit delivery-address allowlist before ingestion resumes; repeated deliveries no longer create duplicate records, and created artifacts no longer trigger playbooks automatically.
  • Local verification at 116d27b: full pre-commit, static analysis, packaging, documentation, and release-note validation passed.
  • Authored by Codex.
  • Merge strategy: merge commit only; do not squash

@github-actions

github-actions Bot commented Aug 5, 2026 •

Copy link
Copy Markdown

Merging this PR will release 4.0.0 with the following release notes:

4.0.0 (2026-08-07)

Connector release changes

  • Default the GreyNoise webhook network allowlist to empty, deduplicate repeated deliveries, and prevent webhook artifacts from automatically running playbooks.

@sodle-splunk
sodle-splunk force-pushed the sodle/authenticate-webhooks branch from 70af50b to 6f488eb Compare August 5, 2026 20:39
@sodle-splunk sodle-splunk changed the title fix!: authenticate webhook deliveries fix!: authenticate and deduplicate webhook deliveries Aug 5, 2026
@sodle-splunk
sodle-splunk force-pushed the sodle/authenticate-webhooks branch 4 times, most recently from f446dd8 to dd1343d Compare August 5, 2026 20:51
PSAAS-31259 defaults webhook exposure to an empty allowlist, deduplicates deliveries through platform source identifiers, and disables automatic artifact automation. GreyNoise documentation does not define request-signature validation, so the connector does not assume a proprietary authentication contract.

Authored by Codex.

BREAKING CHANGE: existing webhook assets must configure an explicit delivery-address allowlist before ingestion resumes; repeated deliveries no longer create duplicate records, and created artifacts no longer trigger playbooks automatically.
BaseConnector apps use the supported pre-commit, static-analysis, and hosted compile validation paths.

Authored by Codex.
@sodle-splunk
sodle-splunk force-pushed the sodle/authenticate-webhooks branch from 8d5d8c3 to 116d27b Compare August 7, 2026 02:25
@sodle-splunk sodle-splunk changed the title fix!: authenticate and deduplicate webhook deliveries fix!: harden and deduplicate webhook deliveries Aug 7, 2026
@sodle-splunk
sodle-splunk marked this pull request as ready for review August 7, 2026 02:30
@sodle-splunk

Copy link
Copy Markdown
Contributor Author

Codex: Closing this Flashpoint remediation PR at the owner's direction. The validation workflow classifies this app as unsupported for this campaign, so this change is being dropped rather than presented for review. The branch remains available if the disposition changes.

@bradchiappetta

Copy link
Copy Markdown
Collaborator

@sodle-splunk did you mean to close this out? I'm thinking this was the wrong PR and we should still review this?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants