Summary

On November 14th, 2026, from 11:07 to 11:45 UTC, the Outpost API (api.outpost.hookdeck.com) was unavailable in all regions.

A security researcher testing Outpost found that the portal custom domain setting accepted any hostname, including our own. They set their portal domain to api.outpost.hookdeck.com, and all API traffic was routed to their portal instead of the API.

From 11:07 to 11:38 UTC, API requests returned 200 OK but were not processed. From 11:38 to 11:45 UTC, they returned 404. Events published during the window were not accepted and were not delivered.

API keys and event data were not exposed.

Timeline

• 11:06 UTC: A deployment's portal custom domain is set to api.outpost.hookdeck.com.
• 11:07 UTC: API traffic starts going to that deployment's portal.
• 11:10 UTC: Our monitoring alerts and the team starts investigating.
• ~11:37 UTC: Root cause identified.
• 11:38 UTC: The account is disabled. API requests return 404.
• 11:45 UTC: The custom domain is removed and the API is restored.

What went wrong

• The custom domain setting accepted hostnames that Hookdeck uses.
• Requests returned 200 OK instead of an error, so clients didn't retry.

Remediation and changes

• Custom domains can no longer be set to any hostname Hookdeck uses.

SLA Credits

SLA credits will be applied to accounts under SLA guarantees.