Bitbucket now supports webhook secrets 🥳

[peterwwillis]

Bitbucket have finally decided to support secrets for webhooks: https://bitbucket.org/blog/enhanced-webhook-security

I'm not sure if there's code that needs updating, but these docs on Bitbucket could probably use updating: https://github.com/adnanh/webhook/blob/master/docs/Hook-Examples.md#incoming-bitbucket-webhook

Confusing matters is the fact that Bitbucket's X-Hub-Signature header is using a SHA256 hash, whereas both GitHub's and Facebook's X-Hub-Signature is SHA1, while their header X-Hub-Signature-256 is SHA256. You'd think after six years they'd want parity with other vendors... but better incompatible than unavailable, I guess 😐

[adnanh]

Better late than never, I guess 😄