Unverified webhook
Part of the Payment safety check · fix arrives as a guide
What it is
A payment webhook handler processes the request body without verifying the provider's signature against the raw payload.
Why it matters
The endpoint is public and its URL is discoverable. Without signature verification anyone can POST a payment_succeeded event and receive whatever your handler grants — a subscription, an unlock, a shipped order.
How to fix it
Verify the signature with the provider SDK before touching the body, using the raw unparsed request — most frameworks parse JSON by default, which changes the bytes and breaks verification. Reject anything that fails, and check the timestamp to bound replay.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.