docuseal-code
Integrates DocuSeal document signing and template management into web and mobile apps using various frontend frameworks and REST API.
Install this skill
Security score
The docuseal-code skill was audited on Jun 9, 2026 and we found 18 security issues across 2 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Webhook reference - potential data exfiltration
| 8 | and webhooks. Use when the user wants to integrate DocuSeal document |
Webhook reference - potential data exfiltration
| 23 | - **`references/api/`** — REST API endpoints and webhooks. One file per endpoint/webhook with parameters, schemas, code examples, and response samples. |
Webhook reference - potential data exfiltration
| 87 | | 11 | **Acting on client-side `completed` events** | Browser events can be forged. Drive state changes from `form.completed` webhooks with HMAC verification, not from `<docuseal-form>` JavaScript cal |
Webhook reference - potential data exfiltration
| 155 | ### Webhooks |
Webhook reference - potential data exfiltration
| 157 | - [Form Webhook](references/api/form-webhook.md) |
Webhook reference - potential data exfiltration
| 158 | - [Submission Webhook](references/api/submission-webhook.md) |
Webhook reference - potential data exfiltration
| 159 | - [Template Webhook](references/api/template-webhook.md) |
Webhook reference - potential data exfiltration
| 161 | Configure webhook URL: https://console.docuseal.com/webhooks |
Webhook reference - potential data exfiltration
| 168 | 4. **Track completion:** poll `GET /submissions/{id}` or configure webhooks for `form.completed` |
Webhook reference - potential data exfiltration
| 180 | 8. **Auth, URL handling, webhook verification, or any security-sensitive embedding?** Load [references/embed/signing-form-security-recommendations.md](references/embed/signing-form-security-recommenda |
External URL reference
| 14 | homepage: https://www.docuseal.com/docs |
External URL reference
| 66 | | JavaScript | — | `https://cdn.docuseal.com/js/form.js`, `https://cdn.docuseal.com/js/builder.js` | |
External URL reference
| 85 | | 9 | **Embedding signing forms behind enumerable URLs** | DocuSeal slugs are random, but an embedding page like `https://yourapp.com/contracts/123/sign` lets an attacker iterate integer IDs to reach |
External URL reference
| 99 | Get your API key: https://console.docuseal.com/api |
External URL reference
| 105 | | Global Cloud | `https://api.docuseal.com` | |
External URL reference
| 106 | | EU Cloud | `https://api.docuseal.eu` | |
External URL reference
| 107 | | Self-hosted | `https://docuseal.yourdomain.com/api` | |
External URL reference
| 161 | Configure webhook URL: https://console.docuseal.com/webhooks |