customerio-webhooks-events

Facilitates handling of Customer.io webhooks for processing delivery events and callbacks, enhancing email marketing automation.

Install this skill

or

0/100

Security score

The customerio-webhooks-events skill was audited on May 12, 2026 and we found 58 security issues across 4 threat categories. Review the findings below before installing.

Categories Tested

Security Issues

medium line 198

Template literal with variable interpolation in command context

SourceSKILL.md

198	console.log(`CIO webhook: ${event.metric} for ${event.customer_id}`);

medium line 203

Template literal with variable interpolation in command context

SourceSKILL.md

203	console.warn(`BOUNCE: ${event.email_address} (user: ${event.customer_id})`);

medium line 217

Template literal with variable interpolation in command context

SourceSKILL.md

217	console.error(`SPAM COMPLAINT: ${event.email_address}`);

medium line 246

Template literal with variable interpolation in command context

SourceSKILL.md

246	`${event.metric}: ${event.delivery_id} to ${event.customer_id}`

medium line 2

Webhook reference - potential data exfiltration

SourceSKILL.md

2	name: customerio-webhooks-events

medium line 3

Webhook reference - potential data exfiltration

SourceSKILL.md

3	description: 'Implement Customer.io webhook and reporting event handling.

medium line 9

Webhook reference - potential data exfiltration

SourceSKILL.md

9	Trigger: "customer.io webhook", "customer.io events",

medium line 21

Webhook reference - potential data exfiltration

SourceSKILL.md

21	- webhooks

medium line 26

Webhook reference - potential data exfiltration

SourceSKILL.md

26	# Customer.io Webhooks & Events

medium line 30

Webhook reference - potential data exfiltration

SourceSKILL.md

30	Implement Customer.io reporting webhook handling: receive real-time delivery events (sent, delivered, opened, clicked, bounced, complained, unsubscribed), verify HMAC-SHA256 signatures, process events

medium line 32

Webhook reference - potential data exfiltration

SourceSKILL.md

32	## How Reporting Webhooks Work

low line 37

Webhook reference - potential data exfiltration

SourceSKILL.md

37	Email sent → POST /webhooks/cio → Verify signature

low line 38

Webhook reference - potential data exfiltration

SourceSKILL.md

38	Email opened → POST /webhooks/cio → Parse event type

low line 39

Webhook reference - potential data exfiltration

SourceSKILL.md

39	Link clicked → POST /webhooks/cio → Route to handler → INSERT INTO events

low line 40

Webhook reference - potential data exfiltration

SourceSKILL.md

40	Email bounced → POST /webhooks/cio → Suppress user

medium line 43

Webhook reference - potential data exfiltration

SourceSKILL.md

43	Configure at: Data & Integrations > Integrations > Reporting Webhooks

medium line 47

Webhook reference - potential data exfiltration

SourceSKILL.md

47	- Public HTTPS endpoint for webhook receiver

medium line 48

Webhook reference - potential data exfiltration

SourceSKILL.md

48	- Webhook signing key from Customer.io dashboard

medium line 53

Webhook reference - potential data exfiltration

SourceSKILL.md

53	### Step 1: Define Webhook Event Types

low line 56

Webhook reference - potential data exfiltration

SourceSKILL.md

56	// types/customerio-webhooks.ts

low line 58

Webhook reference - potential data exfiltration

SourceSKILL.md

58	// Customer.io reporting webhook event metrics

low line 72

Webhook reference - potential data exfiltration

SourceSKILL.md

72	interface CioWebhookEvent {

medium line 98

Webhook reference - potential data exfiltration

SourceSKILL.md

98	### Step 2: Webhook Handler with Signature Verification

low line 101

Webhook reference - potential data exfiltration

SourceSKILL.md

101	// routes/webhooks/customerio.ts

low line 105

Webhook reference - potential data exfiltration

SourceSKILL.md

105	const WEBHOOK_SECRET = process.env.CUSTOMERIO_WEBHOOK_SECRET!;

low line 108

Webhook reference - potential data exfiltration

SourceSKILL.md

108	const expected = createHmac("sha256", WEBHOOK_SECRET)

low line 125

Webhook reference - potential data exfiltration

SourceSKILL.md

125	router.post("/webhooks/customerio", (req: Request, res: Response) => {

low line 135

Webhook reference - potential data exfiltration

SourceSKILL.md

135	console.error("CIO webhook: invalid signature");

low line 140

Webhook reference - potential data exfiltration

SourceSKILL.md

140	const event: CioWebhookEvent = JSON.parse(rawBody.toString());

low line 146

Webhook reference - potential data exfiltration

SourceSKILL.md

146	handleWebhookEvent(event).catch((err) =>

low line 147

Webhook reference - potential data exfiltration

SourceSKILL.md

147	console.error("Webhook processing failed:", err)

low line 155

Webhook reference - potential data exfiltration

SourceSKILL.md

155	// services/customerio-webhook-handler.ts

low line 167

Webhook reference - potential data exfiltration

SourceSKILL.md

167	async function handleWebhookEvent(event: CioWebhookEvent): Promise<void> {

low line 198

Webhook reference - potential data exfiltration

SourceSKILL.md

198	console.log(`CIO webhook: ${event.metric} for ${event.customer_id}`);

low line 202

Webhook reference - potential data exfiltration

SourceSKILL.md

202	async function handleBounce(event: CioWebhookEvent): Promise<void> {

low line 216

Webhook reference - potential data exfiltration

SourceSKILL.md

216	async function handleSpamComplaint(event: CioWebhookEvent): Promise<void> {

low line 229

Webhook reference - potential data exfiltration

SourceSKILL.md

229	async function handleUnsubscribe(event: CioWebhookEvent): Promise<void> {

low line 236

Webhook reference - potential data exfiltration

SourceSKILL.md

236	async function handleEngagement(event: CioWebhookEvent): Promise<void> {

low line 243

Webhook reference - potential data exfiltration

SourceSKILL.md

243	async function handleDelivery(event: CioWebhookEvent): Promise<void> {

low line 256

Webhook reference - potential data exfiltration

SourceSKILL.md

256	import webhookRouter from "./routes/webhooks/customerio";

low line 260

Webhook reference - potential data exfiltration

SourceSKILL.md

260	// Raw body parser for webhook signature verification

low line 263

Webhook reference - potential data exfiltration

SourceSKILL.md

263	"/webhooks/customerio",

low line 275

Webhook reference - potential data exfiltration

SourceSKILL.md

275	app.use(webhookRouter);

low line 277

Webhook reference - potential data exfiltration

SourceSKILL.md

277	app.listen(3000, () => console.log("Webhook server on :3000"));

low line 290

Webhook reference - potential data exfiltration

SourceSKILL.md

290	async function streamToWarehouse(event: CioWebhookEvent): Promise<void> {

medium line 308

Webhook reference - potential data exfiltration

SourceSKILL.md

308	1. Go to Data & Integrations > Integrations > Reporting Webhooks

medium line 309

Webhook reference - potential data exfiltration

SourceSKILL.md

309	2. Click Add Reporting Webhook

medium line 310

Webhook reference - potential data exfiltration

SourceSKILL.md

310	3. Enter your endpoint URL: `https://your-domain.com/webhooks/customerio`

medium line 312

Webhook reference - potential data exfiltration

SourceSKILL.md

312	5. Copy the webhook signing key to `CUSTOMERIO_WEBHOOK_SECRET`

medium line 318

Webhook reference - potential data exfiltration

SourceSKILL.md

318	\| Invalid signature \| Verify webhook secret matches dashboard value \|

medium line 325

Webhook reference - potential data exfiltration

SourceSKILL.md

325	- [Reporting Webhooks](https://docs.customer.io/integrations/data-out/connections/webhooks/)

medium line 326

Webhook reference - potential data exfiltration

SourceSKILL.md

326	- [Webhooks Reference](https://docs.customer.io/integrations/api/webhooks/)

medium line 327

Webhook reference - potential data exfiltration

SourceSKILL.md

327	- [Webhook Action in Campaigns](https://docs.customer.io/journeys/webhooks-action/)

medium line 331

Webhook reference - potential data exfiltration

SourceSKILL.md

331	After webhook setup, proceed to `customerio-performance-tuning` for optimization.

low line 105

Access to .env file

SourceSKILL.md

105	const WEBHOOK_SECRET = process.env.CUSTOMERIO_WEBHOOK_SECRET!;

low line 159

Access to .env file

SourceSKILL.md

159	process.env.CUSTOMERIO_SITE_ID!,

low line 160

Access to .env file

SourceSKILL.md

160	process.env.CUSTOMERIO_TRACK_API_KEY!,

low line 310

External URL reference

SourceSKILL.md

310	3. Enter your endpoint URL: `https://your-domain.com/webhooks/customerio`

Scanned on May 12, 2026

View Security Dashboard

Installation guide →

GitHub Stars 2.4K

Rate this skill

Categorymarketing

UpdatedOctober 27, 2026

claude claude-code codex frontend design api backend email-marketer growth-marketer marketing-analyst marketing

jeremylongshore/claude-code-plugins-plus-skills