This repository is an independent technical sample with hosted dry-run and synthetic-monitor endpoints. It is not a production CRM connector. Security reports are useful when they concern signature or cron authorization, secret exposure, idempotency bypass, SQLite integrity, unsafe replay, or an outbound network call that contradicts the documented boundary.

Do not submit real webhook bodies, customer data, credentials, signing secrets, or CRM tokens with a report. Reproduce with synthetic values.

Prefer the repository's private vulnerability-reporting channel when it is available. If it is not available, contact the repository owner through the public route listed on the owner profile before sharing sensitive details. Do not paste a live secret into a public issue.

Include:

• the affected commit or version;
• a minimal synthetic reproduction;
• expected and observed behavior;
• whether output, SQLite, process arguments, or environment state exposed data; and
• a suggested mitigation if known.

• WEBHOOK_SIGNING_SECRET is read from the process environment and used only to calculate the expected HMAC digest.
• CRON_SECRET must be a distinct random ASCII value of at least 16 characters. Vercel sends it only as a bearer token to /api/monitor; the route compares it in constant time and never includes it in the response or structured log.
• Rotate either secret through the platform secret store and redeploy. Vercel environment changes do not alter already-created deployments.
• The CLI signature argument and signing secret are never intentionally written to JSON output or SQLite.
• Audit metadata is recursively redacted by sensitive field name before storage.
• CLI arguments can be visible to other local processes on some operating systems. The argument interface is for a synthetic demonstration; a production adapter should receive the signature directly from the request header in memory.
• .env is ignored, and the repository does not auto-load it.

Only the current default branch is maintained. The public Vercel dry-run has no availability, response-time, support, or security-service-level commitment.