Agent skill · security · jeremylongshore
customerio-security-basics
Apply Customer.io security best practices.
Why this skill is useful
Provides specific implementation patterns for secure credential storage, PII handling, and webhook verification tailored to Customer.io.
What it needs
Requires customer.io account access. About 4k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Customer.io Security Basics Output A least-privilege Customer.io integration with scoped secrets, approved data attributes, and auditable access ownership. A tested incident path for credential exposure, unauthorized delivery, and sensitive-data handling. Examples Configure a development workspace secret through the approved manager and send a synthetic event that contains no recipient PII. Verify the event uses the intended workspace and attribute allowlist. If a token or customer attribute appears in source or logs, revoke/contain first, then investigate and replace it. Overview Implement security best practices for Customer.io: secrets management for API credentials, PII sanitization before sending data, webhook signature verification (HMAC-SHA256), API key rotation, and GDPR/CCPA data deletion compliance. Prerequisites Customer.io account with admin access Understanding of your data classification (what is PII) Secrets management system (recommended for production) Instructions Step 1: Secure Credential Storage Step 2: PII Sanitization Step 3: Webhook Signature Verification Customer.io signs webhook payloads with HMAC-SHA256. Always verify before processing. Step 4: API Key Rotation Step 5: GDPR/CCPA Data Deletion Security Checklist [ ] API keys stored in secrets manager (not .env in production) [ ] API key rotation schedule set (every 90 days) [ ] Webhook signatures verified (HMAC-SHA256 with timingSafeEqual) [ ] PII sanitized before sending to Customer.io [ ] Highly sensitive data (SSN, credit card) never sent [ ] GDPR deletion endpoint implemented (suppress + destroy) [ ] .env files in .gitignore [ ] Audit log for deletion requests [ ] Minimum necessary data principle applied Error Handling Issue Solution ------- ---------- Credentials exposed in git Rotate immediately, scan git history with trufflehog PII accidentally sent Delete user with destroy(), update sanitization rules Webhook signature mismatch Verify webhook secret matches Customer.io dashboard Key …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/customerio-security-basics--3619d7