Private, signed webhooks isolated by workspace and ready for audit.
DevLog AI reduces uncertainty in GitHub integrations. Its architecture assumes webhook payloads can contain sensitive information.
GitHub signature
Endpoints validate X-Hub-Signature-256 with the workspace or GitHub App Secret.
Isolation
Events are linked to the correct workspace. Members access only what their role permits.
Secret rotation
The dashboard can rotate the webhook Secret and record the action for audit.
Sanitization
Headers and payloads are cleaned to reduce accidental token and secret exposure.
Audit
Critical actions, including Secret rotation, invitations, and billing, are recorded.
Public status
Incidents and system health can be followed on the status page.
Configure GitHub as if the payload could contain private information.
Use HTTPS, keep the Secret outside the repository, rotate credentials if exposure is suspected, invite only necessary members, and avoid unnecessary personal data in events.