fix(jobs): webhook payload includes full DMCA letter text — no size cap, potential multi-MB payload to customer endpoints

[walidboulanouar]

Problem

In packages/jobs/src/lib/webhooks.ts, payload is sent verbatim:

const body = JSON.stringify({ event, data: payload, ts: ..., delivery_id: ... });

The takedown.filed event includes letterEn and letterAr (full DMCA letter text), evidenceUrls, and outcomes. A multi-page DMCA letter in two languages with evidence URLs can be hundreds of KB to low MB per event. No Content-Length cap or truncation exists before the fetch call.

Fix

Strip letter body text from the webhook payload — include only the URL pointers:

const sanitizedPayload = {
  ...payload,
  letterEn: undefined,   // full text — omit from webhook
  letterAr: undefined,
  // letter_url_en and letter_url_ar (signed URLs) already present
};

Or add a generic payload size check: if body.length > 512_000, truncate non-critical fields with a [truncated] marker and log a warning.

Severity

MEDIUM — large payloads cause customer endpoint timeouts, fill customer logs with DMCA letter text, and may expose letter content to third-party webhook processors.

[walidboulanouar]

Verified fixed in commit 337603f — webhook payloads omit DMCA letter text entirely; consumers get a letter_access API pointer (takedown.ts:712-723).