Security hardening: webhooks & product edits

Nothing here changes how you work day to day — these are hardening fixes from a security review of our recent webhooks and editor work. We're calling them out because we think you should be able to see what we're doing to keep your data safe.

Webhooks can only reach the open internet

When you point a webhook at a URL, Fulify now confirms the destination is a genuine public address and refuses internal, private or cloud-metadata ones — both when you save the endpoint and again every time it delivers, and it won't follow redirects to such addresses either. In plain terms: a webhook can't be turned into a way to reach anything behind the scenes.

Product edits stay with your organization

Saving a product now only ever touches the fields you meant to edit. Internal ownership and system fields can no longer be changed through a save, so a product always stays with the organization that owns it.

And one smaller thing

An over-long or malformed webhook URL now gives you a clear error instead of a generic one.