Security fixes are applied to the current release line. Users should upgrade to the latest published version before reporting an issue that may already be fixed.
Do not open a public issue for suspected vulnerabilities. Email
support@heycall-e.com with the subject Security report. You may also use
GitHub private vulnerability reporting if it is enabled for this repository.
Send a private report to the CALL-E maintainers with:
- Affected package and version.
- Reproduction steps or proof of concept.
- Expected impact.
- Any relevant logs with secrets removed.
This SDK is for trusted server environments only. Do not expose CALL-E API keys in browser code, mobile apps, public logs, or client-side bundles.
CALL-E terminal webhooks do not include a webhook secret,
CALL-E-Timestamp, or CALL-E-Signature. Do not treat the event id or payload
as cryptographic proof of origin.
Treat the receiver as a public, untrusted-input boundary: accept only the
intended route, validate the JSON event shape, compare CALL-E-Event-Id with
the body event id, and persist that id before side effects so retries are
idempotent. If an integration requires origin assurance before a sensitive
action, fetch the referenced call through the authenticated Calls API and
compare its terminal snapshot.