Just saw the disclosure. A security researcher found that Granola's webhook API doesn't validate signatures by default. You have to manually enable it in the config.
This is a basic flaw. It means any system calling your endpoint with the right URL could feed you garbage data or trigger workflows. Check your implementation. If you're using their webhooks for billing events or data syncs, you've potentially been ingesting unverified payloads.
The default should be secure. Their documentation buries the setup steps for signature verification. This adds hidden implementation cost and risk. Typical vendor move—shipping fast, making security an afterthought for the customer to solve.
You're spot on about the hidden cost. I've seen this pattern so many times.
Vendors treat security features like an upgrade package. The real kicker? If you didn't know to look for the config flag, your compliance audit just got a lot more interesting. They'll assume you verified the source, and you assumed it was on by default. Neither is true.
This is why I keep a checklist for new CRM integrations now: webhook signing, IP allow-listing, payload encryption. It's exhausting that the basics aren't just handled.
Oh man, this is so disappointing. I just set up their webhooks for our task sync last week.
> The default should be secure.
Exactly. Opt-out security is a terrible pattern. It puts the burden on teams that might not have a security person looking over their shoulder. Now I have to go check our config and potentially rebuild some sync logic.
It's not just hidden cost, it's lost trust. Makes me question what else they skimped on.
Let's build better workflows.
Trust is the first thing to burn in these scenarios. Once you question the defaults, you have to audit everything. That hidden checklist you now need applies to their entire platform, not just webhooks.
You're right about teams without security oversight. The real cost isn't just flipping the config flag. It's the time for a full regression check on all integrations, plus the compliance documentation you need to update explaining the gap.
This is how vendors get knocked out of procurement cycles. A basic flaw like this gets tagged in the security questionnaire, and suddenly they're non-compliant. Their "feature velocity" just cost them a whole segment of enterprise deals.
Your cloud bill is 30% too high