Webhook Delivery Service · View 19 of 20 · Assurance
The threat, stated plainly
- A delivery worker is a request forgery engine pointed at a URL a stranger set. Every control on this page follows from accepting that sentence rather than arguing with it (ADR-12).
- Address validation happens immediately before connect, not only at registration, because DNS can be rebound between the two.
- Redirects are capped at three, re-validated at each hop, refused on a scheme downgrade to HTTP, and signature headers are re-signed rather than forwarded to a host that was not the one signed for.
Defence that survives a bug
- The egress subnets have no route to the capture plane, the control plane, the product, or the instance metadata service. If the address guard has a defect, the network is what contains it.
- The published NAT range is deliberately narrow and deliberately stable — it is what customers allowlist, and it is also what makes this platform's traffic attributable from the outside.
- Signing secrets and payloads sit in the innermost zone with no path from the delivery plane other than a scoped read.
Residual
- A customer can still point an endpoint at a third party's public address and use the platform as a traffic source. Per-endpoint rate caps, the validation challenge and attribution by egress IP bound it; they do not eliminate it.
- Per-tenant egress addresses, which some security reviews will ask for, are Phase 3 and would multiply the NAT footprint.
