Security and daily use - Mattermost

Scope: account and project

The Mattermost configuration lives in two scopes. The account holds the default used by every one of the subscriber's projects. A project inherits it automatically, but for each event type it can explicitly choose its own channel or turn delivery off - independently of the rest of the account. There is also a platform scope, with no account attached: it only serves Dock's own internal-account projects, and a subscriber never uses it.

Who has access

The screen requires the project-management permission, held by the developer, admin and owner roles (and superdeveloper for internal accounts). It is the same matrix as editing the projects themselves.

How the webhook address is stored

The address is encrypted in the database and never comes back to the form in plain text - leaving the field blank on save means 'keep what is there', not 'clear it'. To actually remove the integration, turn the provider off rather than just emptying the field.

Why the webhook address is checked so carefully

A webhook is an address DockRay itself sends a request to - unlike Slack's token, which only authenticates a call to a fixed API. A field holding an arbitrary address that the application queries on its own is a textbook SSRF vector: without a check, it could be used to make the DockRay server query its own internal network with a developer role's permissions. That is why the address goes through the same validation as an enterprise SSO issuer: it must be public HTTPS, with no credentials embedded in the address, and DNS resolution must not point to a private or reserved address. When actually sending, DockRay does not follow redirects - otherwise the address that was checked and the address the request actually reaches could be two different things.

Keeping the team from being flooded

Five event types mean five independent switches - split them across separate channels instead of routing everything into one general channel. A sudden error spike (error-spike) has an extra safeguard independent of this integration: checked every 15 minutes, but sent for the same project at most once every few hours.

Swapping the webhook

Mattermost webhooks do not rotate the way a token does - if you suspect a leak, delete the old webhook in Mattermost's channel settings and create a new one. Paste the new address into DockRay and send a test before calling it done - once deleted on the Mattermost side, the old address simply stops working, so it is worth checking rather than assuming.

When someone leaves the team

A webhook is not tied to a specific Mattermost user account, so someone leaving the team does not invalidate it automatically. If that person administered the integrations and could have seen the webhook address, treat it as a suspected leak and swap it the way described above.