{
  "id": 19985352,
  "title": "Dangling Webhooks: What Happens When a Released Tunnel Subdomain Is Still Registered in Stripe, GitHub or Shopify",
  "url": "https://urgent.news/2026/11/14/dangling-webhooks-what-happens-when-a-released-tunnel-subdomain-is",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-14T13:43:07.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/instatunnel/dangling-webhooks-what-happens-when-a-released-tunnel-subdomain-is-still-registered-in-stripe-1801"
  },
  "original_language": "en",
  "account": "When you terminate a tunnel session, the provider continues to send events to the webhook URL you provided, even though you no longer control that hostname. This is known as a dangling webhook, and it poses a risk of being claimed by someone else. The three major providers involved - Stripe, GitHub and Shopify - handle these dangling webhooks differently. Stripe and GitHub both recycle the hostname for anyone who requests it next, while Shopify requires a reservation to hold the name. The choice of hostname matters because easy-to-guess names are more likely to be taken. Some providers document these policies, while others don't. As a result, you may unintentionally leave behind webhooks that could be claimed by others, potentially leading to security vulnerabilities. The guide provides an audit checklist for each provider, along with a recommended order for unsubscribing and rotating secrets to mitigate these risks.",
  "summary": "You stop the tunnel, close the laptop and move on. Stripe, GitHub and Shopify don’t know that. They keep the URL you gave them and keep trying to deliver events to it until someone removes the registration or the provider gives up. That leftover registration is a dangling webhook : a provider-side subscription that points at a hostname you no longer control. If the name you used was a tunnel…",
  "key_points": [
    "Dangling webhooks continue sending events after tunnel termination.",
    "Stripe and GitHub recycle hostname for next requestor.",
    "Shopify requires reservation to hold name."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}