salesloft-security-basics
Enhances SalesLoft API security by managing OAuth tokens, verifying webhook signatures, and implementing best practices for secure integrations.
Install this skill
Security score
The salesloft-security-basics skill was audited on May 20, 2026 and we found 21 security issues across 4 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 50 | if (!process.env[key]) throw new Error(`Missing required env: ${key}`); |
Template literal with variable interpolation in command context
| 94 | .update(`${timestamp}.${rawBody.toString()}`) |
Webhook reference - potential data exfiltration
| 3 | description: 'Secure SalesLoft OAuth tokens, API keys, and webhook signatures. |
Webhook reference - potential data exfiltration
| 5 | Use when implementing token rotation, securing webhook endpoints, |
Webhook reference - potential data exfiltration
| 28 | Secure SalesLoft API integrations: OAuth token management, webhook signature verification, secret storage, and scope-based access control. SalesLoft uses OAuth 2.0 bearer tokens and HMAC-SHA256 webhoo |
Webhook reference - potential data exfiltration
| 43 | SALESLOFT_WEBHOOK_SECRET=webhook-signing-secret |
Webhook reference - potential data exfiltration
| 77 | ### Step 3: Webhook Signature Verification |
Webhook reference - potential data exfiltration
| 82 | function verifyWebhookSignature( |
Webhook reference - potential data exfiltration
| 88 | // Reject stale webhooks (replay attack prevention) |
Webhook reference - potential data exfiltration
| 115 | - [ ] Webhook endpoints verify signatures before processing |
Webhook reference - potential data exfiltration
| 126 | | Webhook replay attack | Timestamp > 5 min old | Reject request | |
Webhook reference - potential data exfiltration
| 127 | | Brute force on webhook | High 401 rate | Rate limit webhook endpoint | |
Access to .env file
| 36 | .env |
Access to .env file
| 37 | .env.local |
Access to .env file
| 38 | .env.*.local |
Access to .env file
| 40 | # .env |
Access to .env file
| 50 | if (!process.env[key]) throw new Error(`Missing required env: ${key}`); |
Access to .env file
| 116 | - [ ] `.env` files in `.gitignore` |
External URL reference
| 131 | - [OAuth Authorization Code](https://developers.salesloft.com/docs/platform/api-basics/oauth-authentication/) |
External URL reference
| 132 | - [Client Credentials](https://developers.salesloft.com/docs/platform/api-basics/client-creds/) |
External URL reference
| 133 | - [API Logs](https://developers.salesloft.com/docs/platform/guides/api-logs/) |