Webhook Security

Inbound webhook endpoints are protected by provider signatures and rate limits.

• Stripe and Paddle signatures are verified using provider secrets.
• Webhook endpoints are rate-limited under the webhooks limiter.
• Inbound email can be gated by allowed sender domains.

If you suspect a forged webhook, contact support with the delivery identifier.