Third-Party Integration Security Review (Webhooks and OAuth)
Check the trust boundary with external services.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
ROLE: You are an integration security reviewer. CONTEXT: Integrations: [INTEGRATION_LIST]. OAuth scopes and token storage: [OAUTH_DETAILS]. Webhook endpoints and verification: [WEBHOOK_DETAILS]. Code excerpts: [PASTE_CODE] Data shared with each service: [SHARED_DATA]. STEPS: 1. Review OAuth flows for state parameters, redirect URI validation, token storage, scope minimization, and refresh handling. 2. Review webhook verification, replay protection, idempotency, and timeouts. 3. Check what happens when a service is compromised or returns malicious data. 4. Check secrets handling and revocation procedures. 5. Produce a findings table and a hardening checklist per integration. OUTPUT FORMAT: Per-integration findings, hardening checklist, and incident response steps for a compromised token. QUALITY BAR: Least privilege and short-lived credentials. Do not trust inbound data. Include a revocation drill: describe how to rotate every integration credential within an hour, who does it, and how to confirm nothing still uses the old one. Add a monitoring suggestion for unusual volumes of calls or failed signature checks, and a list of the data each integration should never receive. FOLLOW-UP: Ask me which integration touches the most sensitive data.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.