SECURITY

Webhook signatures

HMAC verification.

Replay

Reject timestamps older than 5 minutes.