Changelog
New features, improvements, and fixes shipped to SDNBros Webhooks.
- AI Diagnosis — Authorized users can explicitly request AI analysis for a failed webhook. The result provides a plain-English explanation and fix feasibility percentage. Pro+ plans.
- CloudEvents Support — Native detection and parsing for the CNCF CloudEvents standard. Both binary mode (ce-* headers) and structured mode (JSON envelope) are auto-detected.
- Auto-Migration — Database schema migrations now run automatically on startup. No more manual migration steps during deploys.
- Security Hardening — 30+ security fixes including SSRF protection, SQL injection prevention, command injection prevention, rate limiting on all public endpoints, and atomic password reset.
- Performance — Fixed N+1 queries in SLA, event timeline, and contracts. Added 5 database indexes. Singleflight cache stampede prevention. Project delete now uses CASCADE (10x faster).
- Plan Enforcement — Diagnosis, payload search, and shared links now properly require paid plans.
- Billing — Unknown Stripe prices now default to free plan (fail-closed). Stripe webhooks rejected when secret not configured.
- Raw Body Inspector — View exact bytes, headers, and hex dump for any event. One-click cURL export.
- Editable Replay — Modify webhook body before replaying. Edit JSON in the drawer, click replay.
- Webhook Security Scanner improvements — Added FAQ schema, structured data for AI search engines.
- 27 Provider Detection — Added Twilio. Now auto-detect GitHub, Stripe, Shopify, Slack, PayPal, Twilio, Linear, SendGrid, and 19 more.
- Interactive Sandbox —
/sandbox page with pre-loaded events, live webhook receiving, diagnosis demo.
- SEO Content — 6 new learning pages: what-is-a-webhook, webhook-security, stripe-webhooks, github-webhooks, webhook-vs-api, compare/ngrok.
- Alert Webhook Fix — Alerts now fire on every delivery failure, not just exhaustion.
- Security Hardening — CSP headers, XSS fixes, CORS tightening, bcrypt cost 12, project name sanitization.
- Progressive Disclosure — Features page, pricing, nav, and simulator simplified for new users.
- Webhook Replay to Any URL — Resend any captured webhook to a different endpoint. Great for debugging against localhost, staging, or a colleague's environment.
- Server-Side Bulk Replay — Retry all failed events in one click. Runs server-side instead of sequential browser requests for reliability.
- Replay History Page — Full audit trail of every manual replay: who triggered it, when, where it went, and the result.
- Production Hardening — Custom 5xx error pages, panic recovery middleware, Docker log rotation, backup restore testing, and k6 load test suite.
- Onboarding Flow — New users get a guided setup wizard with visual steps, test webhook button, and real-time confirmation.
- Full-Text Body Search — Search webhook payloads by content. Find that one Stripe event by customer ID.
- Email Failure Alerts — Get email notifications when webhook delivery fails after all retries.
- Rate Limits Dashboard — Visual rate limit monitoring per project with API access.
- Event Export — Export events as JSON or CSV for any plan.
- Retry Dashboard — Visual timeline of delivery attempts with bulk retry, attempt details, and live status.
- Transform Rules — Add, remove, or modify headers before forwarding. Rewrite paths and add query params.
- Provider Auto-Detection — Automatic detection of Stripe, GitHub, Shopify, Twilio, and SendGrid from HTTP headers.
- Observability Stack — Built-in Prometheus, Grafana, Loki, and Alertmanager. 11 alerting rules out of the box.
- API Documentation — Interactive API reference at
/api-docs.
- Usage Bar — Real-time event and project usage meters with upgrade prompts.
- Public Status Page — Service health dashboard at
/status.
- SEO Optimization — Open Graph tags, structured data, custom SVG favicons.
- Automated DB Backups — Daily pg_dump with 14-day retention and cron setup script.
- Provider-Aware Diagnosis Engine — Automatic root cause analysis for Stripe, Shopify, GitHub, Twilio, and SendGrid events. Layered rules detect auth failures, timeouts, rate limits, DNS issues, and more.
- Replay Safety Verdicts — Before replaying, the engine checks idempotency semantics and delivery history to warn about side effects.
- Failure Pattern Detection — Aggregated failure analysis per project: recurring errors, endpoint-down detection, event-type-specific patterns.
- Pattern Dashboard — Visual charts for root causes, provider failures, and failure timelines.
- Stripe Billing — Plan enforcement with checkout and customer portal integration.
- Google OAuth — Sign in with Google, replacing the previous GitLab SSO.
- Analytics Dashboard — Plan-gated analytics with event timelines, error breakdowns, and usage trends.
- Team Support — Invite team members to projects with role-based access (owner, editor, viewer).
- Live Event Stream — Real-time WebSocket feed of incoming webhooks.
- Slack/Discord Alerts — Failure notifications to your team's channels.
- Initial Release — Capture-first webhook inbox with automatic forwarding and retries.
- CLI with Tunnel —
sdnbros tunnel forwards production webhooks to your local dev server via WebSocket.
- Webhook Ingest API — Point any provider at
https://webhook.sdnbros.app/p/{token} and events are stored instantly.
- Events Explorer — Browse, search, and inspect captured webhooks with full headers and bodies.
- Automatic Retries — Exponential backoff with jitter, configurable per project.
- Signature Verification — HMAC verification for major providers.
- Stored Credential Encryption — AES-256-GCM for destination authorization headers and GitLab tokens, plus SSRF protection on delivery.