This library verifies HMAC signatures on webhook style content distribution requests and accepts subscription requests over HTTP. Bugs in either area can mean a malicious party forging notifications or hijacking a subscription. Please report those privately.

Do not open a public GitHub issue for security reports.

Use GitHub Security Advisories to report privately. Please include:

• Which module and version is affected (core, adapter/*, storage/*)
• Whether it affects the Subscriber, Publisher, or Hub role
• A minimal reproduction if possible
• The impact as you understand it, for example "a hub without X validates a forged signature" or "a subscriber accepts unsigned content when a secret was configured"

In scope:

• Signature verification bypass (signature.go)
• Subscription request forgery or hijacking: any party other than the legitimate subscriber or hub able to subscribe, unsubscribe, or receive another party's content
• Denial of service through malformed discovery responses, oversized payloads, or hub delivery retry storms
• Any storage backend issue that could leak subscription secrets

Generally out of scope:

• Issues requiring an already compromised HTTP client or a TLS misconfiguration on the consumer's own infrastructure
• Best practice suggestions without a concrete exploitable impact. Open a normal issue or discussion for those.

We will acknowledge reports within a few days and aim to have a fix or a mitigation plan before any public disclosure. Credit is given in the release notes unless you would prefer otherwise.