webhook-safety-reviewlisted

# Webhook Safety Review ## Install Save this file as `~/.claude/skills/webhook-safety-review/SKILL.md`, or `.claude/skills/webhook-safety-review/SKILL.md` to scope it to one repo. Claude Code auto-discovers it. Invoke with `/webhook-safety-review` or by asking "is my Stripe webhook safe?". ## Why this exists A webhook handler is an unauthenticated public endpoint that a stranger can call, which reacts to it by granting entitlements or moving money. Almost every serious bug in one falls into four buckets, and all four are invisible in normal testing because your own test events are well-behaved. Rank findings by money and access, not by tidiness. ## Step 1 — Find every handler ``` rg --files -g '**/webhook*' -g '**/webhooks/**' -g '**/hooks/**' rg -ln "stripe|github|slack|shopify|twilio|resend|clerk|paddle" -g '**/route.ts' -g '**/*.py' -g '**/*.go' ``` For each, note the sender and what it causes: creating an order, granting a licence, sending mail, updating a subscription. That consequence sets the severity of everything below. ## Step 2 — Signature verification, before anything else The single highest-severity check. Confirm, with file and line: 1. **A signature is verified at all.** No verification means anyone who learns the URL can post a fake `payment_succeeded` and grant themselves goods. 2. **It runs BEFORE the body is parsed or acted on.** Verifying after you have already created a record is decoration. 3. **It uses the RAW body.** Frameworks that au