Checks · WH-002

WH-002 · Webhook replay drill failing

Why it matters

A handler that passes a code review can still accept a fake event or process a duplicate.

How we detect it

The webhook drill on staging did not pass.

How we fix it

Fix the handler the drill failed on. The drill never runs against production.

Can it be fixed automatically? Instructions only

Related checks

• PAY-001 · Stripe webhook without signature verification
• PAY-002 · Price or amount taken from client
• PAY-003 · Paid access granted on redirect not webhook
• PAY-004 · Webhook handler not idempotent