Clear boundaries. Deliberate actions.
How HookRipple protects the requests, credentials and payloads you trust it with.
Workspace isolation
Every operation checks your session and workspace membership. Composite foreign keys and PostgreSQL row-level security add a second boundary, and each service connects with its own restricted database role that cannot bypass those policies.
Encryption
Request definitions, environment secrets, captured payloads and relay history are encrypted with AES-256-GCM using keys held outside the database. Traffic is encrypted in transit end to end, from your browser to Cloudflare and from Cloudflare to our servers.
Outbound processing
Outbound requests run in a separate executor process with no access to the database, sign-in or encryption secrets. It resolves and checks every destination address, pins the connection to the validated address, verifies TLS hostnames, refuses redirects and bounds request and response sizes. The operating system additionally blocks it from private and internal networks.
Untrusted content
Captured payloads are displayed as text and downloaded as attachments. No user scripts run. XML is not expanded, and HTML or SVG responses are never rendered as trusted application content. Webhook ingress lives on a separate, cookie-free host.
Sign-in
HookRipple uses Google and GitHub sign-in only. We never receive or store a password, request only identity and email scopes, and discard provider access tokens. Sessions last seven days and can be revoked from Settings.
Reporting a vulnerability
Please email hello@hookripple.com with details and steps to reproduce. Test only against your own account and data, and give us reasonable time to fix issues before disclosure.