Handlers reviewed: 5
CRITICAL
routes.ts:23 /stripe/webhook — no signature check
attack: a stranger can post a fake payment_succeeded event and receive a paid product for free
handlers.py:12 /github/webhook — verified after acting
attack: a legitimate sender can be impersonated by re-playing a verified event
HIGH
routes.ts:42 — not idempotent on order_id -> retry causes duplicate order
MEDIUM
handlers.py:25 — returns 500 for unknown event type -> infinite retry
routes.ts:67 — sending email before responding
VERIFIED SAFE
handlers.py:5 — signature verified pre-parse, idempotent on event_id, correct statuses
Generated from this listing's real file at upload. The full output is in your download.
⛨Free, and yours to run in your own tools. No account needed.
⛨Human-reviewedEvery listing checked before it goes live
⛨Source-stampedCarries a visible line saying where it came from
⛨Real reviewsOnly verified buyers can rate it
A Claude Code skill for reviewing incoming webhook handlers, which are unauthenticated public endpoints that react by moving money or granting access. Checks signature verification runs on the RAW body before parsing, that handlers are idempotent because senders retry and every event arrives more than once, that heavy work happens after acknowledging, and that status codes are right so an unknown event type does not get retried forever until the provider disables your endpoint. Also flags handlers trusting an amount from the payload instead of re-reading it.
