Did you think StaticResource were a save place to store data, as long as you not expose the name? This article shares how each StaticResource is publicly accessible for each Site and/or Community visitor.
Are you still requiring Outbound Messages for your implementation? Be aware of the Acknowledgement being responded and keep track of NotificationId to prevent a message overload.
Did you know Salesforce has limited the status codes which can be returned in a HTTP Response? This article lists the missing ones and elaborates on how to resolve this.