Harden a webhook receiver
An endpoint that trusts anything posted to it, given signature verification, a replay guard, and a size limit.
The ticket
Add signature verification, replay protection, and a body size limit to one webhook receiver.
Acceptance criteria
- Signatures are verified with a constant-time comparison
- Replayed and stale deliveries are rejected
- Oversized bodies are rejected before parsing
- Each rejection path has its own test
What lands as proof
A test per rejection path, including a forged signature and a replayed delivery.
Why teams defer it
- It works, and the attack it prevents has not happened yet.
- Getting the signature scheme right means reading the provider's documentation carefully, which is an afternoon before any code.
Questions
- What does the agent actually change?
- The ticket is scoped to one outcome: add signature verification, replay protection, and a body size limit to one webhook receiver. Work that serves that outcome is in scope, and anything outside it is left for a separate ticket, so the pull request stays reviewable.
- How do I know the work is done?
- The pull request carries the evidence, not only the diff. Here that means a test for each rejection path, so a reviewer can confirm the result without reproducing the work locally.
- How much oversight does this need?
- None is required before the run starts. Every claim this ticket makes can be checked by machine, so the agent works straight through and a person reviews the finished pull request like any other.