webhook-security

Webhook integration skills for AI coding agents (Claude Code, Cursor, Copilot). Step-by-step guidance for setting up webhook receivers, signature verification, and event handling for Stripe, Shopify, GitHub, and more. Built on the Agent Skills specification.

Claude Code plugin that picks and implements the right payment method for your app — from your terminal. 42 providers, 136 payment rails, and deterministic validators that block insecure payment code as it is written.

Local conformance testing for webhook signature validation, replay protection, and duplicate processing.

Identify and manage n8n workflows with unauthenticated webhooks | Dashboard + backend hooks | Created during live stream

Safe, idempotent webhook handling for Node.js and TypeScript. For managed webhook delivery, retries and event inspection, visit www.webhook-safe.com

Find payment logic flaws in Razorpay and Stripe checkouts - client-trusted amounts, rupee/paise bugs, unverified webhooks

Deterministic B2B Revenue & Compliance Guardrails (Stripe 2025-03-31.basil, Visa CE 3.0, EU/XI VIES VAT, Shopify Net-30) + B2B ATS Hiring-Signal Watchlist, AdPulse & ContactPulse -- Official Model Context Protocol (MCP) Server

workflow library for n8n: install, govern, diff, lint, and drift-check sanitized lead-intake and post-call workflows

Find every webhook-verification bug in your codebase in under five minutes. Three-state verdicts across 24 providers in JS/TS, Python, PHP, and Go. Zero off-machine traffic.

Audit Stripe webhook endpoints for unsigned requests, replay attacks, missing signature verification, and idempotency gaps. MIT.

RFC 8785 JSON Canonicalization Scheme (JCS) with strict validation, and WebCrypto-based SHA-256 / HMAC-SHA256 helpers.

A practical, human-friendly security checklist for SaaS apps built with Vercel, Supabase, and Stripe. Check secrets, RLS, authorization, payments, webhooks, abuse controls, and incident readiness before launch.

Enterprise-grade, Zero-Trust TRC-20 payment webhook gateway built with Go, HashiCorp Vault, Redis, and hardened Kubernetes NetworkPolicies. Features constant-time HMAC verification and atomic replay attack mitigation.

A local-first webhook security inbox for verifying, replay-protecting, and auditing GitHub, Stripe, and generic HMAC deliveries.

Executable Stripe-style webhook reliability reference: signatures, idempotency, reconciliation, entitlements, dead-letter replay, tests, and CI.

Local defensive mutation testing and verifiable evidence for security tests of Python + FastAPI webhook receivers. Detection-first, trusted-local, MIT.

Security-first SMS webhook validation, replay protection, PII redaction, and defensive testing for Twilio, Telnyx, Vonage, Plivo, and HMAC.

Cloudflare Worker guarding a Twilio voice webhook: signature check, ElevenLabs agent handoff, human fallback with a logged reason