Security (medium): webhook responses have no size limit issue #220 closed: completed andymccall opened this 20 days ago · 0 comments

External review: the delivery worker reads and stores the whole response (20 s timeout, no byte ceiling). Stream and stop at 64 KiB, store a short excerpt only; per-hook and per-account limits on concurrency, delivery rate, queue length and stored bytes.