SEV-1: blocks launch

Your Stripe webhook accepts anything

What goes wrong

Someone posts a fake "payment succeeded" event to your endpoint and gets your paid plan for free.

Verify every event with stripe.webhooks.constructEvent, using the raw request body and your webhook signing secret, before you act on it.

npx sigship

Run it in your project. It reports this check as stripe-webhook-unverified, along with 16 others. Nothing leaves your machine.