Checks · WH-001

WH-001 · Inbound webhooks unsigned

Why it matters

An unsigned webhook trusts anyone who can send a request to that URL.

How we detect it

Webhook routes have no HMAC or provider signature check.

How we fix it

Verify a signature on the raw body and reject failures.

Can it be fixed automatically? With review

Related checks

• PAY-001 · Stripe webhook without signature verification
• PAY-002 · Price or amount taken from client
• PAY-003 · Paid access granted on redirect not webhook
• PAY-004 · Webhook handler not idempotent