Agenta v0.94.5: Webhook Security Hardening for Production Deployments

Here at industry sources, we tracked Agenta's security release targeting a specific vulnerability in how webhook delivery records are logged. Version 0.94.5 implements header redaction in webhook delivery records, preventing sensitive authentication tokens, API keys, and custom headers from being exposed in plaintext logs.

This fix addresses a practical attack surface that developers often overlook - webhook logging. When agents trigger external webhooks, the delivery metadata (headers, timestamps, payloads) gets persisted. Without redaction, any credentials passed via headers become accessible to anyone with log access, including team members without API token privileges.

The update applies retroactively to new webhook deliveries and provides clear visibility into which headers are being redacted. This means builders can audit their webhook configurations without sacrificing security observability.

• Sensitive headers automatically stripped from webhook delivery logs
• Maintains audit trail while protecting credentials from exposure
• Clear labeling of redacted fields for debugging purposes
• No breaking changes - applies to existing webhook integrations

Webhook security sits at the boundary between your AI agents and external systems. Many developers compose agents that call third-party APIs - Slack, GitHub, payment processors - via webhooks. Those calls include authorization headers that should never appear in logs.

The logging exposure is particularly dangerous because: (1) logs are often less restricted than code repositories, (2) contractors and support staff frequently need log access for debugging, and (3) many developers don't realize headers are being captured at all. This patch forces intentional security by default rather than optional.

For production agent deployments, this becomes a compliance issue. SOC 2, HIPAA, and PCI audits specifically flag stored credentials in logs as violations. Agenta's fix removes this category of finding from your security report.

• Reduces blast radius if logs are compromised or over-shared
• Simplifies compliance audits by removing credential storage violations
• Prevents accidental credential leakage through log aggregation tools
• Maintains full debugging capability without sacrificing security

If you're running Agenta in production, upgrade immediately - this is a zero-friction security improvement with no configuration required. The redaction applies automatically to new webhook deliveries after the upgrade.

Audit your existing webhook integrations for any credentials passed via headers. Check if you're sending API keys, bearer tokens, or custom auth headers that should now be protected. Agenta won't retroactively redact old logs, so review historical delivery records if compliance teams require it.

Use this as a trigger to review your broader logging practices. If webhooks were leaking headers, check whether your agent LLM calls, database queries, or file uploads are also logging credentials unnecessarily. This single fix should prompt a full security audit of your agent observability stack.

The momentum in this space continues to accelerate.

• Upgrade Agenta to v0.94.5 and verify webhook delivery logs no longer show sensitive headers
• Document which headers your agents send to external services and confirm Agenta is protecting them
• Run a historical log audit if webhooks have been in use for months - identify any exposed credentials
• Use this as a template for fixing logging in other agent components (LLM calls, API integrations)