Please email forint@megzo.biz with details and steps to reproduce. Do not open a public issue for security reports. We'll acknowledge within a few business days and keep you posted on the fix.
- This library signs and verifies webhook requests with HMAC-SHA256. Always sign and verify the exact raw body bytes, and keep the replay window tight (default 300s). Pair it with a nonce/dedup store if you need strict once-only delivery.
- Never commit real Acumatica credentials or webhook secrets — see
.env.example. - When reporting an API error, redact any secrets in
AcumaticaException::$responseBody. - Each Acumatica ROPC sign-in consumes a license seat; the client caches and refreshes the token to avoid churning seats.
The latest released minor version receives security fixes.