klaviyo-security-basics
Implements security best practices for managing Klaviyo API keys and access control to enhance data protection.
Install this skill
Security score
The klaviyo-security-basics skill was audited on May 28, 2026 and we found 33 security issues across 4 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 67 | if (!value) throw new Error(`Missing required env: ${name}`); |
Webhook reference - potential data exfiltration
| 6 | Use when securing API keys, configuring OAuth scopes, implementing webhook |
Webhook reference - potential data exfiltration
| 30 | Security best practices for Klaviyo: API key types, OAuth scopes, webhook HMAC-SHA256 signature verification, and secret rotation procedures. |
Webhook reference - potential data exfiltration
| 55 | KLAVIYO_WEBHOOK_SIGNING_SECRET=whsec_************************* |
Webhook reference - potential data exfiltration
| 74 | webhookSecret: process.env.KLAVIYO_WEBHOOK_SIGNING_SECRET || '', |
Webhook reference - potential data exfiltration
| 96 | ### Step 4: Webhook Signature Verification (HMAC-SHA256) |
Webhook reference - potential data exfiltration
| 98 | Klaviyo signs webhook payloads using HMAC-SHA256 with your webhook signing secret. |
Webhook reference - potential data exfiltration
| 101 | // src/klaviyo/webhook-verify.ts |
Webhook reference - potential data exfiltration
| 105 | * Verify Klaviyo webhook signature. |
Webhook reference - potential data exfiltration
| 106 | * Klaviyo uses the webhook signing secret (set when creating the webhook) |
Webhook reference - potential data exfiltration
| 109 | export function verifyKlaviyoWebhookSignature( |
Webhook reference - potential data exfiltration
| 133 | ### Step 5: Express Webhook Middleware |
Webhook reference - potential data exfiltration
| 138 | app.post('/webhooks/klaviyo', |
Webhook reference - potential data exfiltration
| 141 | const signature = req.headers['klaviyo-webhook-signature'] as string; |
Webhook reference - potential data exfiltration
| 143 | if (!verifyKlaviyoWebhookSignature( |
Webhook reference - potential data exfiltration
| 146 | process.env.KLAVIYO_WEBHOOK_SIGNING_SECRET! |
Webhook reference - potential data exfiltration
| 148 | console.warn('[Security] Invalid webhook signature rejected'); |
Webhook reference - potential data exfiltration
| 190 | - [ ] Webhook signatures verified with HMAC-SHA256 |
Webhook reference - potential data exfiltration
| 202 | | Missing webhook verification | Code review | Add HMAC check | |
Webhook reference - potential data exfiltration
| 210 | - [Webhooks API Overview](https://developers.klaviyo.com/en/reference/webhooks_api_overview) |
Access to .env file
| 52 | # .env (NEVER commit) |
Access to .env file
| 58 | .env |
Access to .env file
| 59 | .env.local |
Access to .env file
| 60 | .env.*.local |
Access to .env file
| 66 | const value = process.env[name]; |
Access to .env file
| 73 | publicKey: process.env.KLAVIYO_PUBLIC_KEY || '', |
Access to .env file
| 74 | webhookSecret: process.env.KLAVIYO_WEBHOOK_SIGNING_SECRET || '', |
Access to .env file
| 146 | process.env.KLAVIYO_WEBHOOK_SIGNING_SECRET! |
Access to .env file
| 187 | - [ ] `.env` files in `.gitignore` |
External URL reference
| 176 | "https://a.klaviyo.com/api/accounts/" |
External URL reference
| 208 | - [Authenticate API Requests](https://developers.klaviyo.com/en/docs/authenticate_) |
External URL reference
| 209 | - [OAuth Setup](https://developers.klaviyo.com/en/docs/set_up_oauth) |
External URL reference
| 210 | - [Webhooks API Overview](https://developers.klaviyo.com/en/reference/webhooks_api_overview) |