• Provider names are constrained before environment-variable lookup.
• Webhook HMAC-SHA256 is checked over the raw body using constant-time comparison.
• A missing provider secret fails closed.
• SQL values use parameters.
• The application container runs as the unprivileged node user.
• CI receives read-only repository permissions.
• Example configuration contains placeholders only.
• RBAC permissions are explicit and deny capabilities that a role has not been granted.

• Put TLS termination and request-size/rate limits in front of the service.
• Replace the generic HMAC contract with each provider's documented signing and timestamp/replay rules.
• Store secrets in a managed secret service and rotate them.
• Add authenticated operator identity, tenant membership, and policy enforcement before exposing management or replay endpoints.
• Define retention/redaction rules for raw payloads and audit records.
• Add readiness checks, structured redacted logs, tracing, and alerts for retry exhaustion.
• Threat-model the selected outbox publisher and its consumers.

Do not report vulnerabilities in public issues. Until a private reporting channel is configured, contact the repository owner privately through their GitHub profile.