Webhook WatchtowerWebhook Watchtower

changelog

What's new

Release notes and version history for Webhook Watchtower.

Changelog

Product updates and improvements to Webhook Watchtower, most recent first.

15 October 2026 — Documentation correction notes

These notes correct historical descriptions; they do not change plan entitlements or announce deployment of the pending forwarding/replay fixes.

  • The 4 June claim that replay was available on all plans conflicts with the API: Scout is denied by the existing replay guard. A product decision is required to reconcile that promise; this correction does not grant or remove entitlements.
  • The historical retry table and exponential-backoff descriptions below are inaccurate for the current worker. Retry waits are 1m, 5m, 30m, then 2h, without jitter. Current plan defaults allow 1/3/5/5 total attempts for Scout/Guard/Sentinel/Bastion; actual workspace settings or grandfathered plans may differ. Alerts are sent when five consecutive exhausted deliveries open the destination circuit.
  • At quota, new ingest returns HTTP 403 before storage; usage resets by UTC calendar month. There is no stored backlog of rejected events. Scout's one-day event history means a failed captured event is not immediately gone forever.
  • Stored headers are not all forwarded. Only the supported provider signature and identity allowlist crosses the relay boundary; credentials and transport metadata are excluded. Original provider signatures cannot guarantee freshness validation for delayed replay.

15 July 2026 - Subscription email reliability

Subscription and payment emails could be silently skipped

Fixed a bug that could stop two important emails from being sent: the confirmation when a subscription starts, and the notice when a payment fails.

Stripe sends several related events when you subscribe or when a card is declined, and it does not guarantee what order they arrive in. Watchtower worked out whether it had already handled an event by looking at your subscription's current state. If a related event arrived first and updated that state, the next event looked like a duplicate, so it was skipped and its email was never sent.

Billing itself was never affected. Your plan, your charges, and your access were always correct. Only the notifications could go missing, which made this hard to notice: a payment could fail and the "update your card" email never arrive.

Watchtower now records every Stripe event by its own unique ID, so each one is handled exactly once regardless of the order it turns up in. If a handler fails, the record is released so Stripe's retry can process it properly rather than being mistaken for a duplicate.

Other fixes

  • Terms of Service linked to a missing pricing page. The Terms pointed to /pricing for the prices you agree to, which returned a "page not found". It now links to the pricing section on the homepage.
  • Invalid billing webhook requests are rejected properly. A request with a bad signature now returns 400 Bad Request instead of a server error, so Stripe stops retrying something that can never succeed.

19 June 2026 - Pre-launch security hardening

A round of hardening across ingest, delivery, billing, and access control.

  • Signature verification now uses the exact bytes you sent. Incoming signature checks (Stripe, GitHub, Shopify, and custom HMAC) and the stored payload now use the raw request body verbatim instead of a re-serialized copy. Re-serializing JSON can change bytes (whitespace, escaping, number formatting) and cause valid signatures to fail; verification is now byte-accurate, and the inspection view shows precisely what was received.
  • Live event stream is access-controlled. The real-time event stream now checks workspace membership before subscribing, matching every other endpoint. No cross-workspace access.
  • Stronger SSRF protection. The outbound destination guard now blocks IPv4-mapped IPv6 addresses (e.g. ::ffff: forms), and pins each delivery to the exact IP it validated, so a malicious destination can't use fast-changing DNS to swap in an internal or metadata address after the safety check passes.
  • Database locked down at the source. Row-Level Security is enforced on every table and direct access by browser-facing roles is revoked, so tenant data is only reachable through the authorized API.
  • More reliable billing updates. Subscription period dates are read defensively across Stripe API shapes, preventing a stuck-retry loop if a field moves between versions.
  • Accurate rate limiting behind the proxy. The API now trusts the platform proxy so per-user rate limits key on the real client IP.
  • Admin panel fully gated. The admin area is now hidden from non-admin accounts at the page level, in addition to the existing API-level enforcement.

11 June 2026 - SSRF redirect hardening

Closed a server-side request forgery gap in webhook delivery. Previously the SSRF guard validated the original destination URL, but the outbound request followed HTTP redirects automatically, so a destination could return a 3xx pointing at an internal address (for example a cloud metadata endpoint) and bypass the check. Delivery now follows redirects manually and re-runs the full SSRF guard on every hop, capping the number of redirects. A redirect to a private, loopback, link-local, or reserved address is blocked and recorded as a failed delivery attempt.

9 June 2026 - Outgoing webhook signatures, usage notifications, and cron migration

Outgoing webhook signatures

Every webhook Watchtower forwards to your destinations is now cryptographically signed. Each workspace has its own unique signing secret. You can view it and rotate it from Settings → Security. Two headers are added to every outgoing request:

  • x-watchtower-timestamp - Unix seconds at delivery time
  • x-watchtower-signature - sha256=<HMAC-SHA256> of timestamp.body signed with your workspace secret

Use these to verify that requests to your destination genuinely came from Watchtower and haven't been tampered with. Signatures are always on: no configuration required.

Usage limit notifications

When your workspace reaches 80% or 100% of its monthly event quota, Watchtower now sends both an in-app notification and an email. Notifications are sent once per threshold per month, so you won't be spammed if you hover around a limit. At 100%, new events are rejected at ingest until the next billing cycle.

Internal cron jobs and delivery reconciler

Scheduled jobs (data retention cleanup and daily check-ins) have moved from Vercel's cron to run directly inside the API process on Railway. This removes the Vercel Hobby plan cron limit and makes scheduling more reliable.

A new outbox reconciler job now runs every five minutes. It finds any deliveries that were accepted but never picked up by the queue worker (for example if the worker restarted mid-flight) and re-queues them automatically. This closes the gap between "event received" and "delivery attempted."

All cron executions are now logged to the database. Admins can view job history and last-run status at /admin/cron, and trigger any job manually with a "Run now" button without waiting for the next scheduled run.

8 June 2026 - Service reliability improvements

Ingest endpoints now have per-source rate limiting to protect service availability for all users. Limits are set well above what any standard webhook provider sends under normal conditions, so this won't affect legitimate integrations. If a source does exceed the limit, it receives a 429 response and can retry.

8 June 2026 - Sensitive data masking

Webhook payloads and headers can contain credentials, customer data, and provider signature values. Each source now has a Data masking setting that hides sensitive values in the event viewer without affecting delivery.

When masking is on, auth headers (Authorization, Cookie, X-Api-Key) and provider signature headers are automatically hidden. You can extend this with a custom list of header names and dot-notation JSON field paths (e.g. data.card.number) specific to that source. Masked values appear as [redacted] in the dashboard. Raw data is always preserved and forwarded to destinations unchanged.

Configure it from the source row: open the three-dot menu and select Data masking.

8 June 2026 - Duplicate detection, provider picker, and production hardening

Duplicate event detection

Webhook providers retry events when they don't get a quick response. This used to mean your application could receive and process the same event twice. Watchtower now detects duplicates automatically before they reach your destination:

  • Stripe events are matched by their evt_xxx ID from the request body: exact and instant
  • GitHub events are matched by the X-GitHub-Delivery UUID header
  • Shopify events are matched by the X-Shopify-Webhook-Id header
  • Custom sources fall back to a SHA-256 hash of the raw request body, matched within a 24-hour window

Duplicates are stored with a Duplicate label linking back to the original, are not forwarded to your destinations, and do not count toward your monthly event usage.

Provider picker for source creation

Creating a source now starts with a provider selection step: choose Stripe, GitHub, Shopify, or Custom. Picking a known provider pre-fills the source name, sets the signing secret field label to the right format, and turns on signature rejection by default. Custom sources leave rejection off while you get set up.

Worker health monitoring

A new /health/worker endpoint is available for external uptime monitoring (UptimeRobot, BetterUptime, etc.). It returns 200 when everything is healthy and 503 if the queue is stalled or Redis is unreachable. The admin queue view also now shows stalled jobs (deliveries that have been running for more than two minutes) with their job IDs.

SSRF protection

Destination URLs are now validated before saving and again before each delivery. Attempts to send webhooks to private IP ranges (RFC1918, loopback, link-local, and CGNAT) are blocked with a clear error message.

Billing reliability

Stripe webhook handlers now check current database state before sending email notifications, so retried Stripe events (which Stripe sends when your handler doesn't respond in time) don't produce duplicate emails.

6 June 2026 - Mobile polish and event stream improvements

Event stream

  • Event list is now mobile-friendly - event rows reflow cleanly on small screens. The delivery status and timestamp sit comfortably on the right without truncating the source name on the left.
  • Row selection no longer takes up space when inactive - the checkbox on each event row collapses to zero width when not in use, and only appears on hover (or when a selection is already active). No wasted space on the left of every row.

General UI

  • Workspace picker cleaned up - the workspace selection screen shows a simple list of workspace names. Role labels and initials avatars removed.
  • Brand no longer shown twice - pages that have a navigation header no longer also show the logo and product name inside the card. Auth pages (sign in, register, etc.) still show the brand since they have no nav bar.

4 June 2026 - Pre-launch hardening

A focused sweep across billing, notifications, UI copy, and the landing page ahead of open sign-up.

Billing reliability

  • customer.deleted now handled - if a Stripe customer record is deleted, the workspace is immediately downgraded to the free plan. Previously this event was silently ignored and a paid workspace could remain active indefinitely.
  • Subscription webhook resilience - subscription events now fall back to a Stripe customer ID lookup if metadata is missing on the event. Early subscriptions or edge cases that lacked workspace metadata in Stripe now resolve correctly instead of dropping silently.
  • Event retention now enforced - events are now automatically cleaned up nightly in line with your plan's retention limit. Scout, Guard, and Sentinel workspaces each retain events for their advertised window and no longer.

Notifications

  • New signup alerts - the team is now notified whenever a new workspace is created, so we can reach out and make sure you have everything you need from day one.
  • Upgrade and downgrade emails - workspace owners are now emailed when a plan upgrade or cancellation/downgrade occurs, alongside the existing payment failure emails.
  • All transactional emails rebuilt - every email you receive from Webhook Watchtower now uses a consistent branded template. Welcome, invite, delivery failure, circuit breaker, payment, upgrade, and downgrade emails all share the same clean look.

UI copy cleanup

Removed internal product jargon across billing, usage, project, and onboarding pages. Plain English throughout:

  • Billing page labels rewritten - no more "visibility volume", "operational coverage", "recovery capacity", "investigation window"
  • Onboarding step copy simplified - "Activation complete" → "All set", step descriptions de-jargoned
  • Project page - removed "Project control surface" kicker, removed a placeholder "Success rate" stat that was permanently empty

Landing page fixes

  • Footer added - Privacy policy, Terms of service, and Changelog links are now in the page footer. These pages existed but nothing linked to them from the marketing site.
  • Scout plan corrected - the Scout pricing tier falsely listed "No manual replay" as a restriction. Replay is available on all plans and the claim has been removed.

19 May 2026 - Delivery status clarity and dashboard accuracy

Know exactly where your deliveries stand

Delivery status on both the event list and event detail page now reflects what's actually happening, not just the end state.

  • Retrying - a delivery that has failed at least once but still has attempts remaining now shows "Retrying" (amber) on the event list. Previously it showed "Failed" even though the system was still working on it.
  • Attempt count on the detail page - the delivery card now shows exactly where you are in the retry cycle, e.g. "Retrying - attempt 2/3". Once all attempts are exhausted it clearly reads "Failed - all 3 attempts exhausted". No more guessing whether the system has given up or is still trying.
  • Replay only unlocks when retries are exhausted - the Replay button on the event detail page now only appears when a delivery has truly failed. While the system is still retrying, replay is not shown so you can't accidentally interfere with an in-progress delivery.

Dashboard event count fixed

The "Events today" stat and the 7-day chart on the dashboard were both capped at a page of events rather than your actual total. Both now pull from a proper database count, so the numbers are accurate regardless of how busy your workspace is. The counter also increments in real time as new events arrive. No refresh needed.

18 May 2026 - App UI overhaul and site polish

New app navigation

The logged-in app has a proper top bar and a cleaner sidebar. The top bar holds test mode, notifications, and theme switching. The sidebar is now much leaner: brand at the top, navigation in the middle, and a single workspace/profile element at the bottom that shows your workspace name and email and opens a dropdown for switching workspaces or signing out. No more duplicate headings, no more blue rail bars cluttering the nav items.

On mobile the sidebar collapses entirely and a hamburger menu opens a slide-in drawer, the same pattern used on the marketing site.

Dashboard tidied up

Removed a redundant "Command centre" label that was sitting above the page title. The dashboard now has a single clear heading and the action cards no longer look identical to data cards.

Projects page

Removed a stat card that displayed "Routing model: Explicit", a philosophy note masquerading as dashboard data.

18 May 2026 - Site polish and mobile experience

A round of fit-and-finish improvements across the marketing site, sign-in flow, and onboarding.

Mobile navigation

The site now has a proper mobile menu. Tap the hamburger icon to open a full-screen overlay with all the nav links, sign in, and sign up. No more squinting at a cramped header on a small screen.

Consistent look across sign-in and onboarding

Every page you hit before you're inside the app (sign in, register, forgot password, workspace creation, invite acceptance) now shares the same clean card layout and keeps the brand header at the top. Previously these pages had a mixed look that felt disconnected from the rest of the site.

Social share image

The preview image that appears when you share a Webhook Watchtower link on Twitter, Slack, or LinkedIn has been redesigned. It now matches the site's dark navy theme and typography, rather than showing an older style that didn't reflect how the product looks today.

Clearer "Works with" section

The integrations strip on the landing page now distinguishes between providers where Webhook Watchtower can verify webhook signatures natively (Stripe, GitHub, Shopify) and providers whose webhooks are forwarded and monitored without built-in signature support. You're never misled about what's included out of the box.

Request access page

The pre-launch request access page has been updated to match the sign-in and register pages: same card layout, same header, same feel.

14 May 2026 - Plan rename, pricing update, and reliability fixes

Plans renamed: Scout, Guard, Sentinel

The three pricing tiers have been renamed to better reflect what they do:

  • Hobby → Scout - kick the tyres, no commitment
  • Startup → Guard - for teams who can't afford to drop events
  • Pro → Sentinel - for infrastructure you can't afford to lose

Pricing changes

  • Scout event limit reduced from 250 to 50 per month, since Scout is intended for exploration and integration testing, not production volume
  • Scout no longer includes manual replay: replay requires Guard or Sentinel
  • Guard now includes manual replay
  • Sentinel price updated to £49/mo (was £29). Founding members who signed up during beta keep their original rate
  • Sentinel now explicitly includes queue health monitoring and priority support

Founding member pricing

Scout stays free. Guard and Sentinel are available at early access rates for the first 50 customers. These prices are locked in for life, even as we raise them after beta.

Auth reliability

  • API now returns 401 for authentication failures (was 500 in some paths)
  • API now returns 400 for validation errors (was 200 in some paths)
  • Both fixes affect programmatic API consumers; the app UI was already handling these cases correctly

12 May 2026 - Pre-launch polish

A focused pass covering stats, diagnostics, UI, and reliability ahead of wider launch.

Live stats on the landing page

The landing page now shows real, live numbers (total events processed, active sources, and workspace count) pulled directly from the platform. Numbers update every 30 seconds with a smooth animated count and a pulsing live indicator, so visitors can see the platform is active.

Delivery error classification

Every delivery attempt now records a structured error category alongside the raw error message:

  • Connection error - the destination was unreachable (refused connection, DNS failure, etc.)
  • Timeout - the destination took longer than 10 seconds to respond
  • HTTP 4xx - the destination actively rejected the request
  • HTTP 5xx - the destination returned a server error
  • Config error - the destination was deleted, inactive, or had no URL configured

This makes it straightforward to diagnose why deliveries are failing at a glance, rather than digging through raw error strings.

Sky-blue rebrand

The product's colour palette has moved from purple/violet to sky blue (#38bdf8). The change runs through the full stack: the logged-in app, marketing site, gradients, shadows, and component styles.

Sitemap

/terms and /privacy pages were missing from the sitemap and have been added. The complete public surface is now available at /sitemap.xml.

Marketing site refresh

The public-facing site has had a full visual pass: unified navigation across landing, blog, changelog, and marketing pages; pricing links and section anchors that land in the right place; and a more intentional dark/light theme presentation.

Error handling across the app

Previously, if an API call failed on certain pages (dashboard, event list, event detail, billing, usage, members, audit log), the page would silently show nothing. Every one of those cases now surfaces a clear error message so you always know what went wrong.

Empty states

A new workspace now shows a clear empty state on the dashboard with a prompt to set up a first project. The audit log empty state now includes an icon and explanatory text. Project-not-found shows a panel with a back button instead of a blank page.

Settings

The workspace name field in Settings was not loading on page open due to a missing API call. It now correctly pre-fills with your current workspace name.

Onboarding reliability

The project and source creation steps in the onboarding wizard now handle network errors gracefully, showing a clear message instead of crashing the wizard.

Feedback link

A Feedback or bug report link is now in the sidebar footer. It opens a pre-filled email so you can reach us without leaving the app.

Minor fixes

  • Batch replay failures now show an error toast instead of silently stopping
  • Destination URL input now uses type="url" for browser-native validation
  • Auth pages now display user-facing messaging instead of internal developer notes when registration is closed

10 May 2026 - Public launch

Webhook Watchtower is now live. You can sign up, create a workspace, and start capturing webhooks today.

Signature verification

Sources can verify the signature of every incoming webhook before storing or forwarding it. Set up verification on any source: pick your provider (Stripe, GitHub, Shopify, or custom HMAC-SHA256), paste in your signing secret, and choose whether to quarantine events that fail.

Every event is stamped with a verification result:

  • Verified - signature matched, event forwarded as normal
  • Failed - signature did not match. If quarantine mode is on, the event is stored but not forwarded. The exact failure reason is recorded and shown in the event detail view
  • Skipped - source is configured for custom verification but no recognised signature header was found

The event detail page shows the verification status prominently in the header and as a node in the delivery timeline.

Delivery retries

Failed deliveries are now automatically retried based on your plan:

PlanAttemptsRetry schedule
Scout1No retries, manual replay only
Guard31 min, 2 min
Sentinel51 min, 2 min, 4 min, 8 min

Retries use exponential backoff. If all attempts fail, a notification email is sent to workspace owners and an in-app notification is created.

Audit log

Every action in your workspace is now recorded: who did it, when, and what changed. The audit log covers sources, destinations, members, and event replays. Each entry shows a before/after diff of what changed, with sensitive fields like signing secrets masked. Find the full log under Settings → Audit log. Source and destination rows also have a History button that expands an inline timeline.

Soft delete and restore

Sources and destinations are no longer permanently deleted on the first click. Deleting a resource soft-deletes it: the ingest URL stops accepting events immediately, but the record is kept. Workspace owners can restore from the audit history.

Batch replay

Select multiple events on the event stream page and replay all their failed deliveries in one action. Safe against races: if a delivery succeeded between you selecting and hitting replay, it is automatically skipped.

Signature badge on event list

Every event row now shows a shield icon when verification is configured on the source: green for verified, red for failed, grey for skipped. No need to open the event to see whether it was trusted.

Live event stream

The event list page connects via SSE and shows new events in real time. A "Live" badge appears in the header when connected. If filters are active, a banner counts incoming events and lets you refresh without losing your filter state.

Usage page

The plan usage page now shows real data: event counts, delivery stats, and a 30-day event chart, all measured against your plan limits.

What else launched with v1.0

  • Workspace invites - invite teammates by email; new users land directly in your workspace with the right role assigned
  • Source token rotation - rotate your ingest URL secret at any time; the old URL stops working immediately
  • Delivery attempt history - every delivery attempt shown on the event detail page with status, response code, and response body
  • Data retention - events automatically cleaned up based on your plan (Scout: 1 day, Guard: 7 days, Sentinel: 30 days)
  • Billing - Stripe-powered subscription management; upgrade, downgrade, or cancel from workspace settings
  • Error monitoring - delivery failures trigger notification emails to workspace owners so you're never the last to know

April 2026 - Delivery and routing

Core webhook delivery pipeline shipped.

  • Destinations - connect any HTTP endpoint as a delivery target. Webhooks are forwarded asynchronously with full delivery tracking.
  • Delivery tracking - every attempt recorded with response status, response body, and timing.
  • 10 MB ingest limit - oversized payloads are rejected immediately with a clear error response.
  • Workspace roles - owner, admin, and member roles enforced consistently across the app.

March 2026 - Foundation

Initial build: auth, workspaces, projects, sources, and event capture.

  • Auth - email/password login with a staged launch mode to control access during early development.
  • Workspaces - multi-member workspaces with onboarding flow.
  • Projects - group sources and destinations into projects.
  • Sources - unique, secure ingest URLs per source.
  • Event capture - headers, raw body, method, and timestamps stored on every ingest.
  • Event timeline - workspace-level list view and per-event detail view.