Security reviews off private add ons

Developer General
1

Has anyone had a private ServiceM8 add-on independently security reviewed?
Ours uses Netlify, cloud storage, signed handoffs, staff auto-login, PDF uploads and notifications. I haven’t identified a specific breach issue, but I’d like to confirm the architecture and storage are secure. Any recommendations for a specialist familiar with ServiceM8/OAuth?

2

@Cody can you comment on the above? and risks with private add ons using cloud storage , any help here is great

3

Hi Joshua,

A good starting point is the ServiceM8 Partner Directory. Some Partners work with custom integrations, but not every Partner offers every service, so confirm they provide independent application-security and OAuth reviews before engaging them.

An OAuth add-on doesn’t need to be publicly listed in the Add-on Store, so your reviewer can assess it as a private deployment while using ServiceM8’s OAuth documentation as the integration baseline.

Given the components you’ve listed, we’d include these ServiceM8-specific checks in the review scope:

  • The callback accepts requests over HTTPS and verifies each JWT’s HMAC-SHA-256 signature using the App Secret.
  • The App Secret is kept confidential, as access to it could allow another party to impersonate the app.
  • OAuth scopes are limited to the permissions the add-on actually needs.
  • Data handling, storage, disclosure and retention are documented and reviewed against applicable privacy requirements.

Use the Authentication and Web Service Hosted Add-ons documentation as part of the brief when contacting candidates.

Thanks,
Cody

4

Hi Joshua,

For this setup, the review should cover the whole add-on, not only the ServiceM8 connection. ServiceM8 supports web-service add-ons hosted with any cloud provider, but the endpoint must use HTTPS, and callback events are JWTs signed with HMAC-SHA-256 using the add-on’s App Secret.

We’d have the reviewer check these ServiceM8-specific areas:

  • Keep the App Secret confidential, as someone with access to it could impersonate the app and access connected ServiceM8 accounts.
  • Request only the OAuth scopes the add-on needs.
  • Validate incoming signed JWTs before accepting a handoff.
  • For staff-specific API permissions, use OAuth’s x-impersonate-uuid header with an active staff UUID, which applies that staff member’s authorised access.
  • Document what ServiceM8 and uploaded data is stored, disclosed and retained, including the PDF lifecycle and access to cloud storage.

We can’t confirm the security of the Netlify and storage architecture from a public description, and don’t post any App Secrets or tokens here. A good next step is to contact candidates through the ServiceM8 Developer Partner Directory and ask them to scope an independent review covering OAuth, signed handoffs, staff access, cloud storage, PDF uploads and notifications. Some ServiceM8 Partners build custom integrations, but not all Partners offer every service, so confirm that security assessment is within their scope.

Thanks,
Cody