Webhook security: a hands-on guide

This post details the security engineering practices for PlanetScale's webhook service. It covers SSRF mitigation through strict URL validation (HTTPS, IP/domain blocking, DNS resolution) and HTTP egress rules using Envoy Proxy. DDoS mitigation strategies include API rate limiting, webhook uniqueness checks with Sidekiq, isolated infrastructure, strict timeouts, and limiting the number of webhooks per database.