Scan rule · RSC-SEC-061
Webhook without signature verification
SecuritySeverity: HighCWE-345
Detects payment webhooks that process the payload without verifying the signature — anyone could fake a payment.
Scan tier
Source code from source mapsRepo access (deep scan)
How to fix it
Verify the signature with the webhook secret (`constructEvent`) and reject invalid requests.