Inbound webhook secrets stored in plaintext and replayable signatures

[santoshkumarradha]

Summary

• Inbound webhook triggers persist signing secrets in plaintext and echo them back in API responses. CreateTrigger sets SecretHash to the raw secret and returns it, and RotateSecret does the same on every rotation.
• Signature verification accepts any timestamp; there is no freshness check or replay protection, so a captured body + signature can be replayed indefinitely.

Impact

• Anyone with database/backup access (or logs of the creation response) can recover every webhook secret and forge requests. There is no hashing/encryption to limit blast radius.
• Because timestamps are not validated, an intercepted webhook can be replayed forever as long as the body/signature pair is known, bypassing idempotency TTLs.

Evidence

• control-plane/internal/handlers/webhook_triggers.go:104-151 stores SecretHash: secret and returns "secret": <raw> in the creation response; RotateSecret returns the raw secret as well.
• control-plane/internal/webhooks/signature.go:26-37 validates the HMAC but never enforces timestamp age/skew, and ReceiveWebhook trusts whatever timestamp is provided (webhook_triggers.go:479-488).

Recommendation

• Store webhook secrets hashed or envelope-encrypted; avoid returning them after creation/rotation (surface only once or offer a short-lived token retrieval endpoint guarded by auth/audit).
• Enforce timestamp freshness (e.g., 5–10 minute skew window) and reject stale or non-numeric timestamps; consider adding nonce-based replay protection.
• Add migrations/tests to cover secret-at-rest handling and replay rejection so regressions are caught.

[riturajFi]

Hey @santoshkumarradha , i would love to be asssigned this

[santoshkumarradha]

@riturajFi, welcome 👋! please go ahead and feel free to create a PR

[github-actions]

Hey @riturajFi! 👋

Just a friendly reminder that you're assigned to this issue. It's been about a week since assignment.

How's it going? We'd love to hear:

• Any progress updates?
• Running into any blockers we can help with?
• Need more time? (Totally fine!)

A quick comment helps us know you're still interested. If your plans have changed, no worries at all - just let us know and we can find another contributor.

Thanks for contributing to AgentField! 🚀

[riturajFi]

Hey @riturajFi! 👋

Just a friendly reminder that you're assigned to this issue. It's been about a week since assignment.

How's it going? We'd love to hear:

• Any progress updates?
• Running into any blockers we can help with?
• Need more time? (Totally fine!)

A quick comment helps us know you're still interested. If your plans have changed, no worries at all - just let us know and we can find another contributor.

Thanks for contributing to AgentField! 🚀

The PR is going good. I am in planning phase. Today would move to implementation and we can expect a PR latest by saturday (2 days)

[github-actions]

Hey @riturajFi! 👋

Just a friendly reminder that you're assigned to this issue. It's been about a week since assignment.

How's it going? We'd love to hear:

• Any progress updates?
• Running into any blockers we can help with?
• Need more time? (Totally fine!)

A quick comment helps us know you're still interested. If your plans have changed, no worries at all - just let us know and we can find another contributor.

Thanks for contributing to AgentField! 🚀

[github-actions]

Hi @riturajFi,

Just checking in again! It's been 14 days since we last heard from you on this issue.

Quick options:

• 💬 Drop a comment with a progress update
• 🔗 Link a draft PR if you've started working on it
• 👋 Let us know if you'd like to be unassigned (no judgment!)

If we don't hear back in 7 days, we'll unassign this issue to give other contributors a chance to help.

Thanks for understanding!