hookproof verifies webhook signatures, so its correctness is security-critical. We take vulnerabilities seriously and appreciate responsible disclosure.

Please do not open a public issue for security vulnerabilities.

Instead, report privately via GitHub Security Advisories (Security → Report a vulnerability).

Please include:

• A description of the vulnerability and its impact.
• Steps to reproduce (a minimal proof-of-concept if possible).
• Affected version(s) and runtime.

Do not include real secrets, tokens, or production payloads.

• We aim to acknowledge reports within 3 business days.
• We'll work with you on a fix and a coordinated disclosure timeline.
• With your permission, we'll credit you in the release notes.

Especially interested in:

• Any way to make a forged signature verify (bypass).
• Timing side-channels in comparison.
• Replay-window bypasses on timestamped schemes.
• A provider whose implementation diverges from its official specification.

hookproof is pre-1.0; security fixes land on the latest published release. Once 1.0 ships, this section will document the supported range.