From 5a8dea85fbb636ae09adafa2272d511ae1e227a3 Mon Sep 17 00:00:00 2001 From: kshitijk4poor <82637225+kshitijk4poor@users.noreply.github.com> Date: Thu, 1 Oct 2026 22:04:13 +0530 Subject: [PATCH] docs(webhook): header-less deliveries get a random per-request id, not a timestamp --- website/docs/guides/webhook-github-pr-review.md | 2 +- website/docs/user-guide/messaging/webhooks.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/website/docs/guides/webhook-github-pr-review.md b/website/docs/guides/webhook-github-pr-review.md index c875c7b9cd..bff438a3c9 100644 --- a/website/docs/guides/webhook-github-pr-review.md +++ b/website/docs/guides/webhook-github-pr-review.md @@ -282,7 +282,7 @@ GitLab payload fields differ from GitHub's — e.g. `{object_attributes.title}` - **Never use `INSECURE_NO_AUTH`** in production — it disables signature validation entirely. It is only for local development. - **Rotate your webhook secret** periodically and update it in both GitHub (webhook settings) and your `config.yaml`. - **Rate limiting** is 30 req/min per route by default (configurable via `extra.rate_limit`). Exceeding it returns `429`. -- **Duplicate deliveries** (webhook retries) are deduplicated via a 1-hour idempotency cache. The cache key is `X-GitHub-Delivery` if present, then `X-Request-ID`, then a millisecond timestamp. When neither delivery ID header is set, retries are **not** deduplicated. +- **Duplicate deliveries** (webhook retries) are deduplicated via a 1-hour idempotency cache. The cache key is `X-GitHub-Delivery` if present, then `X-Request-ID`, then a random per-request ID. When neither delivery ID header is set, retries are **not** deduplicated. - **Prompt injection:** PR titles, descriptions, and commit messages are attacker-controlled. Malicious PRs could attempt to manipulate the agent's actions. Run the gateway in a sandboxed environment (Docker, VM) when exposed to the public internet. --- diff --git a/website/docs/user-guide/messaging/webhooks.md b/website/docs/user-guide/messaging/webhooks.md index 55c70f41a1..85ed2851f8 100644 --- a/website/docs/user-guide/messaging/webhooks.md +++ b/website/docs/user-guide/messaging/webhooks.md @@ -624,7 +624,7 @@ Requests exceeding the limit receive a `429 Too Many Requests` response. ### Idempotency -Delivery IDs (from `X-GitHub-Delivery`, `svix-id`, `webhook-id`, `X-Request-ID`, or a timestamp fallback) are cached for **1 hour**. Duplicate deliveries (e.g. webhook retries) are silently skipped with a `200` response, preventing duplicate agent runs. +Delivery IDs (from `X-GitHub-Delivery`, `svix-id`, `webhook-id`, `X-Request-ID`, or a random per-request ID) are cached for **1 hour**. Duplicate deliveries (e.g. webhook retries) are silently skipped with a `200` response, preventing duplicate agent runs. ### Body size limits