saas-securitylisted

<!-- Native skill bundle for agent-skills (cross-tool convention). Generated by `secure-vibe dev regenerate`. --> <!-- Do not edit by hand; the source of truth is skills/saas-security/SKILL.md. --> # SaaS Integration Security Wiring your application to a third-party SaaS platform: verifying an inbound webhook against the vendor's own scheme rather than a generalized one, why a valid signature identifies the sender and not the user in the payload, replay windows, one credential per integration and per environment, least-privilege scopes, and treating a bulk export as a data boundary. Use when writing a webhook receiver, an OAuth integration, a SCIM endpoint, or any code that authenticates to or from a SaaS vendor. ## ALWAYS - Verify an inbound webhook against **that vendor's documented scheme**, and do not generalize from another one. Vendors differ in the header, in the secret, and — the part that breaks a generalized implementation — in the **canonical string** that gets signed. Some sign the raw body, some sign a version prefix plus a timestamp plus the body, some sign the HTTP method and path as well. Read the vendor's page for the vendor you are integrating; a signature routine copied from a different vendor produces a receiver that rejects every legitimate event, and the fix someone reaches for is to turn verification off. - Verify against the **raw request body**, exactly as received, before any parsing or re-serialization. A framework that decodes JSON and re-encod