This project is pre-1.0. Security fixes are applied to the latest published 0.x release.

Please do not report security vulnerabilities through public GitHub issues.

Instead, report them privately via GitHub Security Advisories (the Security → Report a vulnerability tab on the repository), or email the maintainer at mail@jtang.ae.

Please include:

• a description of the issue and its impact,
• steps to reproduce (a minimal proof of concept if possible),
• affected version(s).

You can expect an initial response within a few business days.

This adapter sits on a trust boundary between Intercom and your application. Areas that are especially security-relevant:

• Webhook verification - every incoming webhook is verified with an HMAC-SHA1 signature (X-Hub-Signature) computed from your Intercom app's client secret, using a constant-time comparison. Requests that fail verification are rejected with 401 before any processing.
• Secret handling - credentials (INTERCOM_ACCESS_TOKEN, INTERCOM_CLIENT_SECRET, model API keys) are read from configuration or environment variables and are never logged. Keep them in a gitignored .env or your platform's secret manager; never commit them.

If you find a way to bypass signature verification, leak a credential, or otherwise compromise a deployment, please report it as described above.