Dangling Webhooks: What Happens When a Released Tunnel Subdomain Is Still Registered in Stripe, GitHub or Shopify
You stop the tunnel, close the laptop and move on. Stripe, GitHub and Shopify don’t know that. They keep the URL you gave them and keep trying to deliver events to it until someone removes the registration or the provider gives up. That leftover registration is a dangling webhook : a provider-side subscription that points at a hostname you no longer control. If the name you used was a tunnel…
When you terminate a tunnel session, the provider continues to send events to the webhook URL you provided, even though you no longer control that hostname. This is known as a dangling webhook, and it poses a risk of being claimed by someone else. The three major providers involved - Stripe, GitHub and Shopify - handle these dangling webhooks differently.
Stripe and GitHub both recycle the hostname for anyone who requests it next, while Shopify requires a reservation to hold the name. The choice of hostname matters because easy-to-guess names are more likely to be taken. Some providers document these policies, while others don't. As a result, you may unintentionally leave behind webhooks that could be claimed by others, potentially leading to security vulnerabilities.
The guide provides an audit checklist for each provider, along with a recommended order for unsubscribing and rotating secrets to mitigate these risks.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
