Security
VerifyRelay handles authentication traffic, so it's built like it. Here's exactly what protects the API.
- API-key auth: Every send requires X-API-Key, compared in constant time against the server-side key.
- Twilio signature verification: Status callbacks are HMAC-verified against your Twilio auth token whenever it's configured.
- Input validation: E.164 phone validation, message length caps, and a 1 MiB request-body limit on every endpoint.
- No secret logging: Structured JSON logs record request metadata only — never API keys, codes, or message bodies.
- Config via environment: All credentials live in env vars; nothing is hardcoded. Sample values only in .env.example.
- TLS at the edge: Terminate TLS at your reverse proxy (Caddy/nginx); the app binds loopback by default.
Known limits (we'd rather you read them here)
- Vonage webhook signature verification is roadmap — IP-allowlist that endpoint.
- Rate limiting is in-app for the claim and free-signup endpoints (per-IP); put additional throttling at the proxy for internet-facing deploys. The hosted API is not deployed yet — self-serve provisioning activates with its first deployment.
Questions or a vulnerability to report? Contact us — security reports go to the top of the queue.
