Webhook without signature verification
Scan rule · RSC-SEC-061
- Security
- Severity: High
- CWE-345
Detects payment webhooks that process the payload without verifying the signature — anyone could fake a payment.
Scan tier
- Source code from source maps
- Repo access (deep scan)
How to fix it
Verify the signature with the webhook secret (`constructEvent`) and reject invalid requests.