klaviyo-deploy-integration

Facilitates the deployment of Klaviyo integrations on Vercel, Fly.io, and Google Cloud Run with secure configuration management.

Install this skill

or

53/100

Security score

The klaviyo-deploy-integration skill was audited on May 28, 2026 and we found 23 security issues across 3 threat categories. Review the findings below before installing.

Categories Tested

Security Issues

medium line 74

Curl to non-GitHub URL

SourceSKILL.md

74	curl -s https://your-app.vercel.app/api/health \| jq '.services.klaviyo'

medium line 145

Curl to non-GitHub URL

SourceSKILL.md

145	curl -s https://my-klaviyo-app.fly.dev/health \| jq

low line 47

Webhook reference - potential data exfiltration

SourceSKILL.md

47	vercel env add KLAVIYO_WEBHOOK_SIGNING_SECRET production

low line 64

Webhook reference - potential data exfiltration

SourceSKILL.md

64	{ "source": "/webhooks/klaviyo", "destination": "/api/webhooks/klaviyo" }

medium line 77

Webhook reference - potential data exfiltration

SourceSKILL.md

77	#### Vercel Webhook Handler (Edge-compatible)

low line 80

Webhook reference - potential data exfiltration

SourceSKILL.md

80	// api/webhooks/klaviyo.ts (Vercel serverless function)

low line 93

Webhook reference - potential data exfiltration

SourceSKILL.md

93	const signature = req.headers['klaviyo-webhook-signature'];

low line 95

Webhook reference - potential data exfiltration

SourceSKILL.md

95	.createHmac('sha256', process.env.KLAVIYO_WEBHOOK_SIGNING_SECRET!)

low line 105

Webhook reference - potential data exfiltration

SourceSKILL.md

105	console.log('Klaviyo webhook:', event.type);

low line 138

Webhook reference - potential data exfiltration

SourceSKILL.md

138	fly secrets set KLAVIYO_WEBHOOK_SIGNING_SECRET=whsec_***

low line 171

Webhook reference - potential data exfiltration

SourceSKILL.md

171	echo -n "whsec_***" \| gcloud secrets create klaviyo-webhook-secret --data-file=-

low line 183

Webhook reference - potential data exfiltration

SourceSKILL.md

183	--set-secrets=KLAVIYO_PRIVATE_KEY=klaviyo-private-key:latest,KLAVIYO_WEBHOOK_SIGNING_SECRET=klaviyo-webhook-secret:latest \

medium line 223

Webhook reference - potential data exfiltration

SourceSKILL.md

223	- Webhook endpoint with HMAC signature verification

medium line 232

Webhook reference - potential data exfiltration

SourceSKILL.md

232	\| Webhook 401 \| Wrong signing secret \| Verify secret matches Klaviyo dashboard \|

medium line 244

Webhook reference - potential data exfiltration

SourceSKILL.md

244	For webhook handling, see `klaviyo-webhooks-events`.

low line 95

Access to .env file

SourceSKILL.md

95	.createHmac('sha256', process.env.KLAVIYO_WEBHOOK_SIGNING_SECRET!)

low line 203

Access to .env file

SourceSKILL.md

203	const session = new ApiKeySession(process.env.KLAVIYO_PRIVATE_KEY!);

low line 74

External URL reference

SourceSKILL.md

74	curl -s https://your-app.vercel.app/api/health \| jq '.services.klaviyo'

low line 145

External URL reference

SourceSKILL.md

145	curl -s https://my-klaviyo-app.fly.dev/health \| jq

low line 237

External URL reference

SourceSKILL.md

237	- [Vercel Environment Variables](https://vercel.com/docs/environment-variables)

low line 238

External URL reference

SourceSKILL.md

238	- [Fly.io Secrets](https://fly.io/docs/apps/secrets/)

low line 239

External URL reference

SourceSKILL.md

239	- [Cloud Run Secrets](https://cloud.google.com/run/docs/configuring/secrets)

low line 240

External URL reference

SourceSKILL.md

240	- [Klaviyo API Reference](https://developers.klaviyo.com/en/reference/api_overview)

Scanned on May 28, 2026

View Security Dashboard

Installation guide →

GitHub Stars 2.4K

Rate this skill

Categorymarketing

UpdatedOctober 27, 2026

claude-code backend api email-marketer growth-marketer product-marketer vercel marketing

jeremylongshore/claude-code-plugins-plus-skills