February 2024 Summaries

Convoy has achieved SOC2 Type 1 compliance, highlighting its commitment to data security, transparency, and adherence to industry standards. This milestone, validated by the auditing firm Insight Assurance, demonstrates Convoy's dedication to protecting sensitive customer information by aligning with stringent SOC2 requirements for security, availability, processing integrity, confidentiality, and privacy. The audit not only confirms the company's robust security posture and risk management procedures but also reflects its focus on maintaining customer trust. Convoy acknowledges the achievement as a critical step toward further improvements, aiming for SOC2 Type 2 certification, and expresses gratitude to Insight Assurance for their expert evaluation and to customers for their support. The company remains committed to ethical data practices and ongoing diligence in enhancing its security measures.

A Stripe webhook incident led to a Denial of Service (DoS) attack on a Vercel function, resulting in a $23,000 bill due to 63GB of serverless execution over two days. This occurred when an attacker created approximately 545,000 fake accounts and subscriptions on Stripe, triggering Vercel to become overwhelmed as Stripe retried the unprocessed webhooks. The incident highlights the importance of implementing rate limits and spend management controls for serverless workloads to prevent cascading failures. While some suggested using Cloudflare or verifying HMAC signatures as solutions, these were deemed ineffective due to the legitimate nature of webhook requests. The recommended approach involves both webhook providers and consumers applying rate limiting and circuit-breaking strategies to manage webhook traffic effectively, ensuring better control and prevention of similar situations in the future.