[ambers7]

Summary

Checks that the Mailgun signature is from Mailgun and that the email was cryptographically signed by venmo.com, instead of someone changing the webhook POST to show being sent by Mailgun or changing the email to show Venmo.

• verifies webhook POST was sent by Mailgun
• verifies email was sent with Venmo using with DKIM (DomainKeys Identified Mail)
• tests tampered signature, missing env var, missing/malformed message headers, and more

TODO:

• add MAILGUN_WEBHOOK_SIGNING_KEY to env locally

How to test

Test with npx jest email.handlers.test.ts in backend

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
curaise	Ready	Preview	Oct 28, 2026 7:59pm UTC

[CLAassistant]

All committers have signed the CLA.

[8ddieHu0314]

Hi Amber, thank you for the bug fix! A few changes: for the DKIM failure, it is better to return 406 instead of 401 so that it won't retry constantly at an interval. Also, please resolve the merge conflict

[Arsh-S]

Thanks Amber, looks good! One gap: the DKIM check only looks at the first DKIM-Signature header, so a fake d=venmo.com header in front of a real signature from another domain would pass. Check all of them. I'll handle the rebase after. @ambers7

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: QUIET
• Plan: Advanced
• Run ID: cba28f89-1d10-4d2b-85ac-8a32be2a76e4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}