🔁 🔐 HMAC, Hashtags & Audit Gaps: Fixing Your Serverless Webhook for Real-Time Trust 🛠️

📦 GitHub Webhooks Decoded

Why your serverless listener isn’t rotating civic hashtags or verifying GitHub events…

🛠️ What’s Missing
❌ No logic to extract or rotate hashtags
❌ No storage or update mechanism
❌ No raw body capture for HMAC integrity (needed on platforms like Vercel)

🔍 Hashtag Rotation Logic

Your listener doesn’t parse commit messages, issue titles, or PR descriptions for hashtags. There’s no function to:

• Extract #tags from payloads
• Store them in a rotating queue or database
• Update civic dashboards or rolling tickers

✅ Fix: Add a parser that scans req.body for hashtags and pushes them to a rotation module or Redis queue.

📦 Storage and Update Mechanism

Even if hashtags are extracted, they’re not saved anywhere. No database, cache, or file system is used to persist or rotate them across sessions.

✅ Fix: Use a lightweight store (e.g., Redis, Supabase, or Firebase) to log hashtags and rotate them every X minutes.

🔐 Raw Body Capture for HMAC Integrity

Platforms like Vercel parse the body before you can hash it, breaking HMAC verification. GitHub signs the raw payload, so you must capture it before any parsing.

// Example for Vercel export const config = { api: { bodyParser: false, }, }; import { buffer } from 'micro'; const rawBody = await buffer(req);

✅ Fix: Use req.rawBody or a custom body parser middleware to preserve the raw string for HMAC comparison.

🧭 Civic Impact

• 🚫 Your dashboard won’t reflect trending civic hashtags
• 🛑 You risk spoofed or tampered GitHub events
• 📉 Your API loses audit-grade integrity

✅ With these fixes, you get verified, rotating civic signals and build public confidence in your infrastructure.

📚 Glossary (Kid-Friendly)

Term	Meaning
Webhook	A message GitHub sends when something happens
Hashtag	A keyword with # used to tag topics
Rotation	Changing what’s shown every few seconds or minutes
HMAC	A secret math check to prove a message is real
Raw Body	The untouched message before any changes
Serverless	Code that runs online without managing a physical server

Author: Peter M. Mutiti | Investigative Journalist & Civic Technologist

MIT License © 2025 Peter M. Mutiti · View License