This release closes a security gap in shipment tracking webhook verification and corrects a regional email routing bug that could have sent UK-region
Corey Alan 0.12.1
Corey Alan Consulting 0.12.1
This release closes a security gap in shipment tracking webhook verification and corrects a regional email routing bug that could have sent UK-region messages through the wrong account and endpoint.
• Shipment tracking webhook verification is now cryptographically secure
• Fixed regional email routing so UK messages use the correct Mailgun domain and account
Fixed
Hardened shipment tracking webhook verification
The Shippo tracking webhook now uses timing-safe HMAC-SHA256 verification over the raw request body and fails closed on any mismatch, replacing a weaker check that just compared a header to a stored secret.
Corrected regional email routing
Email sending now points at the actual provisioned Mailgun domains for each region (US, EU, MX). Previously the UK region wasn't recognized and would silently fall back to the US account and endpoint, and the bare domains used before would have been rejected by the send API.
Where it's live
Web — live
You're receiving this because you subscribed to Corey Alan Consulting product updates. Unsubscribe
Get the latest insights on technology, development tutorials, and exclusive content delivered straight to your inbox. Join my community of developers and tech enthusiasts.
