Hugh Brown 4d1dbb4098 security: add HMAC signature verification to webhook ingest ...

Webhook ingest endpoint was completely unauthenticated. Add an optional
`secret` field to BoardWebhook. When configured, inbound requests must
include a valid HMAC-SHA256 signature in X-Hub-Signature-256 or
X-Webhook-Signature headers. Uses hmac.compare_digest for timing safety.
Includes migration to add the secret column.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-07 23:35:10 +05:30

..

versions

security: add HMAC signature verification to webhook ingest

2026-03-07 23:35:10 +05:30

__init__.py

refactor: update module docstrings for clarity and consistency

2026-02-09 15:49:50 +05:30

env.py

refactor: standardize runtime annotation types across multiple files

2026-02-09 17:24:21 +05:30

script.py.mako

refactor: update migration paths and improve database operation handling

2026-02-09 00:51:26 +05:30