flexport-security-basics

# Flexport Security Basics ## Overview Flexport manages global freight logistics containing shipping manifests, customs declarations, commercial invoices, and supply chain partner data. A breach exposes trade routes, commodity values, importer/exporter identities, and customs brokerage details. Secure API credentials, webhook endpoints, and any pipeline that processes shipment tracking or purchase order data. ## API Key Management ```typescript function createFlexportClient(): { apiKey: string; baseUrl: string } { const apiKey = process.env.FLEXPORT_API_KEY; if (!apiKey) { throw new Error("Missing FLEXPORT_API_KEY — store in secrets manager, never in .env in production"); } // Never log the key; log only a hash suffix for debugging console.log("Flexport client initialized (key suffix:", apiKey.slice(-4), ")"); return { apiKey, baseUrl: "https://api.flexport.com/v2" }; } ``` ## Webhook Signature Verification ```typescript import crypto from "crypto"; import { Request, Response, NextFunction } from "express"; function verifyFlexportWebhook(req: Request, res: Response, next: NextFunction): void { const signature = req.headers["x-hub-signature"] as string; const secret = process.env.FLEXPORT_WEBHOOK_SECRET!; const expected = "sha256=" + crypto.createHmac("sha256", secret).update(req.body).digest("hex"); if (!signature || !crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) { res.status(401).send("Invalid signature"); return; ...