Security at HookLogs
Layered controls protect accounts, ingestion endpoints, stored events, and outbound replay. HookLogs does not claim a certification it has not earned.
Transport and account security
Production traffic is served over HTTPS. Passwords use bcrypt with cost 12. Browser sessions use random server-hashed tokens in Secure, HTTP-only, SameSite cookies and expire after 30 days. Reset links are hashed, one-time, and expire after one hour.
Google and GitHub sign-in use Authorization Code with PKCE and one-time state validation. Google identity tokens are validated server-side for signature, issuer, audience, expiration, and nonce. Provider access tokens are not stored.
Webhook tokens and request controls
Public URLs use cryptographically secure 160-bit random tokens and old tokens stop working immediately after regeneration. Optional HMAC-SHA256 and IPv4/IPv6 allowlists protect receivers. Bodies are bounded while streaming, and rate limits apply by source IP, webhook, and account.
Payload handling and XSS protection
Authorization, Proxy-Authorization, cookies, API keys, and common structured secret fields are redacted before storage. Payloads are always treated as untrusted input and rendered as escaped React text, never executable HTML. Avoid credentials in unstructured raw text.
Retention and account isolation
Scheduled retention physically deletes expired events according to the active plan. Every authenticated category, channel, webhook, event, API key, alert, replay, saved view, and share query is authorized server-side against the current owner.
Replay safety
Replay blocks credentials, local/private/metadata targets, unsafe headers, redirects, and nonstandard ports. Responses are time- and size-bounded and every attempt is logged.
Report an issue
Send reports to security@alazwar.site with reproduction steps and impact. Do not include live credentials or customer payloads.