fix(triggers): address review — fail-closed auth, Twilio event filtering, user-only secrets

- Twilio: add matchEvent so inbound-SMS and status-callback triggers don't
  cross-fire on a shared webhook URL (inbound = SmsStatus 'received')
- Rootly + RevenueCat: verifyAuth now fails closed (401) when the signing
  secret is absent from provider config (both auto-register, so it is always
  present after deploy) instead of skipping verification
- Mark every user-provided credential field paramVisibility 'user-only'
  (Clerk, incident.io, RevenueCat, Sentry, Twilio) so secrets are never
  exposed as LLM-visible trigger params
- Sentry: correct metric_alert web_url description per docs

Author: waleedlatif1

apps/sim/lib/webhooks/providers/revenuecat.test.ts

@@ -47,7 +47,7 @@ describe('RevenueCat webhook provider', () => {
   describe('verifyAuth', () => {
     const secret = 'super-secret-header-value'
 
-    it('allows requests when no secret is configured', async () => {
+    it('rejects requests when no secret is configured (fail-closed)', async () => {
       const res = await revenueCatHandler.verifyAuth!({
         request: requestWithAuth(),
         rawBody: '{}',
@@ -56,7 +56,7 @@ describe('RevenueCat webhook provider', () => {
         webhook: {},
         workflow: {},
       })
-      expect(res).toBeNull()
+      expect(res?.status).toBe(401)
     })
 
     it('rejects requests missing the Authorization header', async () => {

apps/sim/lib/webhooks/providers/revenuecat.ts

@@ -22,10 +22,11 @@ const REVENUECAT_API_BASE = 'https://api.revenuecat.com/v2'
 /**
  * RevenueCat webhook handler.
  *
- * RevenueCat does not sign payloads. Instead, the user configures an Authorization
- * header value in the RevenueCat dashboard that is sent verbatim on every request.
- * We verify the incoming `Authorization` header against the configured secret using
- * a timing-safe comparison.
+ * RevenueCat does not sign payloads. Instead, an Authorization header value is sent
+ * verbatim on every request. Sim generates this secret and sets it when it creates the
+ * webhook integration (see `createSubscription`), so it is always present once the
+ * trigger is deployed. We verify the incoming `Authorization` header against it using a
+ * timing-safe comparison and fail closed if the secret is missing from config.
  *
  * @see https://www.revenuecat.com/docs/integrations/webhooks
  */
@@ -34,10 +35,12 @@ export const revenueCatHandler: WebhookProviderHandler = {
     const secret = providerConfig.authHeaderSecret as string | undefined
 
     if (!secret) {
-      logger.debug(
-        `[${requestId}] RevenueCat webhook has no Authorization secret configured, skipping verification`
+      logger.warn(
+        `[${requestId}] RevenueCat webhook missing Authorization secret in provider configuration`
       )
-      return null
+      return new NextResponse('Unauthorized - RevenueCat Authorization secret is required', {
+        status: 401,
+      })
     }
 
     const authHeader = request.headers.get('authorization')

apps/sim/lib/webhooks/providers/rootly.test.ts

@@ -41,6 +41,21 @@ describe('Rootly webhook provider', () => {
     expect(res).toBeNull()
   })
 
+  it('rejects when the signing secret is missing from config (fail-closed)', async () => {
+    const rawBody = JSON.stringify({ event: { id: 'evt-1', type: 'incident.created' }, data: {} })
+
+    const res = await rootlyHandler.verifyAuth!({
+      request: new NextRequest('http://localhost/test'),
+      rawBody,
+      requestId: 'rootly-t1b',
+      providerConfig: {},
+      webhook: {},
+      workflow: {},
+    })
+
+    expect(res?.status).toBe(401)
+  })
+
   it('rejects a request with an invalid signature', async () => {
     const secret = 'rootly-secret'
     const timestamp = Math.floor(Date.now() / 1000).toString()

apps/sim/lib/webhooks/providers/rootly.ts

@@ -67,7 +67,8 @@ export const rootlyHandler: WebhookProviderHandler = {
   }: AuthContext): Promise<NextResponse | null> {
     const secret = providerConfig.webhookSecret as string | undefined
     if (!secret) {
-      return null
+      logger.warn(`[${requestId}] Rootly webhook missing signing secret in provider configuration`)
+      return new NextResponse('Unauthorized - Rootly signing secret is required', { status: 401 })
     }
 
     const header = request.headers.get('X-Rootly-Signature')

apps/sim/lib/webhooks/providers/twilio.test.ts

@@ -134,6 +134,36 @@ describe('twilioHandler', () => {
     })
   })
 
+  describe('matchEvent', () => {
+    const match = (triggerId: string, body: Record<string, unknown>) =>
+      twilioHandler.matchEvent!({
+        body,
+        request: new Request('http://localhost/test') as never,
+        rawBody: '',
+        requestId: 'r1',
+        providerConfig: { triggerId },
+        webhook: {},
+        workflow: {},
+      })
+
+    const inbound = { MessageSid: 'SM1', From: '+1', Body: 'hi', SmsStatus: 'received' }
+    const status = { MessageSid: 'SM1', MessageStatus: 'delivered', SmsStatus: 'delivered' }
+
+    it('routes inbound messages only to the received trigger', () => {
+      expect(match('twilio_sms_received', inbound)).toBe(true)
+      expect(match('twilio_sms_status', inbound)).toBe(false)
+    })
+
+    it('routes delivery callbacks only to the status trigger', () => {
+      expect(match('twilio_sms_status', status)).toBe(true)
+      expect(match('twilio_sms_received', status)).toBe(false)
+    })
+
+    it('passes through when no triggerId is configured', () => {
+      expect(match('', inbound)).toBe(true)
+    })
+  })
+
   describe('formatInput', () => {
     const ctx = (body: Record<string, unknown>) => ({
       webhook: {},

apps/sim/lib/webhooks/providers/twilio.ts

@@ -1,6 +1,7 @@
 import { verifyTwilioAuth } from '@/lib/webhooks/providers/twilio-signature'
 import type {
   AuthContext,
+  EventMatchContext,
   FormatInputContext,
   FormatInputResult,
   WebhookProviderHandler,
@@ -24,6 +25,23 @@ export const twilioHandler: WebhookProviderHandler = {
     return verifyTwilioAuth(ctx, 'Twilio SMS')
   },
 
+  /**
+   * Distinguish an inbound SMS from a delivery status callback so the two
+   * triggers don't fire on each other's deliveries when they share a URL.
+   * Twilio reports `SmsStatus: 'received'` for inbound messages; status
+   * callbacks carry a delivery `MessageStatus` (queued/sent/delivered/…).
+   */
+  matchEvent({ body, providerConfig }: EventMatchContext) {
+    const triggerId = providerConfig.triggerId as string | undefined
+    if (!triggerId) return true
+    const b = body as Record<string, unknown>
+    const status = (((b.MessageStatus as string) || (b.SmsStatus as string)) ?? '').toLowerCase()
+    const isInbound = status === 'received'
+    if (triggerId === 'twilio_sms_received') return isInbound
+    if (triggerId === 'twilio_sms_status') return !isInbound
+    return true
+  },
+
   extractIdempotencyId(body: unknown) {
     const obj = body as Record<string, unknown>
     return (obj.MessageSid as string) || (obj.CallSid as string) || null

apps/sim/triggers/clerk/utils.ts

@@ -67,6 +67,7 @@ export function buildClerkExtraFields(triggerId: string): SubBlockConfig[] {
       placeholder: 'whsec_...',
       description: 'Copy this from your Clerk webhook endpoint to verify event signatures.',
       password: true,
+      paramVisibility: 'user-only',
       required: true,
       mode: 'trigger',
       condition: { field: 'selectedTriggerId', value: triggerId },

apps/sim/triggers/incidentio/utils.ts

@@ -62,6 +62,7 @@ export function buildIncidentioExtraFields(triggerId: string): SubBlockConfig[]
       description:
         'The signing secret from your incident.io webhook endpoint. Used to verify events.',
       password: true,
+      paramVisibility: 'user-only',
       required: true,
       mode: 'trigger',
       condition: { field: 'selectedTriggerId', value: triggerId },

apps/sim/triggers/revenuecat/utils.ts

@@ -86,6 +86,7 @@ export function buildRevenueCatExtraFields(triggerId: string): SubBlockConfig[]
       title: 'API Key',
       type: 'short-input',
       password: true,
+      paramVisibility: 'user-only',
       placeholder: 'RevenueCat v2 Secret API key (sk_...)',
       description:
         'Secret API key with the project_configuration:integrations:read_write permission. Sim uses it to create and remove the webhook in RevenueCat.',

apps/sim/triggers/sentry/utils.ts

@@ -48,6 +48,7 @@ export function buildSentryExtraFields(triggerId: string): SubBlockConfig[] {
       type: 'short-input',
       placeholder: "Paste your Sentry Internal Integration's Client Secret",
       password: true,
+      paramVisibility: 'user-only',
       required: true,
       mode: 'trigger',
       condition: { field: 'selectedTriggerId', value: triggerId },
@@ -199,7 +200,7 @@ export function buildMetricAlertOutputs(): Record<string, TriggerOutput> {
     },
     description_text: { type: 'string', description: 'Human-friendly description of the alert' },
     description_title: { type: 'string', description: 'Human-friendly title of the alert' },
-    web_url: { type: 'string', description: 'Browser URL for the incident' },
+    web_url: { type: 'string', description: 'API URL for the incident' },
   }
 }