Security hardening

Secrets

• Only publishable keys ship in client code.
• Signing secrets exist only on servers you control; rotate on any suspicion of leak.
• Do not commit any key to source control — read from env or a secret store.

Network

• Always use HTTPS. Never override baseUrl to a non-TLS host in production.
• If you tunnel via a proxy, keep the same TLS assurances end-to-end.

Data

• Do not log full request bodies with device identifiers in your own logs unless you need to.
• Configure privacy per app — IP collection defaults to off; enable only what you need.

Webhooks

• Verify webhook signatures on your receiver.
• Return a non-2xx response on verification failure; the sender will retry.