# Harden a webhook receiver

An endpoint that trusts anything posted to it, given signature verification, a replay guard, and a size limit.

Category: API surface and contracts
Source: https://letsship.ai/use-cases/harden-a-webhook-receiver
Published: 2026-08-25

## Goal

Add signature verification, replay protection, and a body size limit to one webhook receiver.

## Acceptance criteria

- Signatures are verified with a constant-time comparison
- Replayed and stale deliveries are rejected
- Oversized bodies are rejected before parsing
- Each rejection path has its own test

## What lands as proof

A test per rejection path, including a forged signature and a replayed delivery.

## Prompt

Copy this to an agent to open the ticket:

```text
Create a Linear issue in my team and assign it to the SHIP agent.

Title: Harden the {provider} webhook receiver

Description: Add signature verification, replay protection, and a body size limit to one webhook receiver.

Acceptance criteria:
- Signatures are verified with a constant-time comparison
- Replayed and stale deliveries are rejected
- Oversized bodies are rejected before parsing
- Each rejection path has its own test

Before you create the issue, find a webhook receiver in this repository without signature verification and replace {provider} with it.
```

## Questions

### What does the agent actually change?

The ticket is scoped to one outcome: add signature verification, replay protection, and a body size limit to one webhook receiver. Work that serves that outcome is in scope, and anything outside it is left for a separate ticket, so the pull request stays reviewable.

### How do I know the work is done?

The pull request carries the evidence, not only the diff. Here that means a test for each rejection path, so a reviewer can confirm the result without reproducing the work locally.

### How much oversight does this need?

None is required before the run starts. Every claim this ticket makes can be checked by machine, so the agent works straight through and a person reviews the finished pull request like any other.