Home / patterns

Stripe webhooks not verified

Quick answer: If your webhook grants access whenever it receives a 'payment succeeded' body, anyone can fake it. Verify the Stripe-Signature header.

Last updated October 14, 2026

Steps

  1. Use stripe.webhooks.constructEvent with your endpoint secret.
  2. Pass the raw request body, not parsed JSON.
  3. Store event IDs so retries are handled idempotently.

Why it matters

This is a common failure pattern in apps built quickly with AI coding tools. The steps above check your own app only. Never test apps you don't own.

Want an expert to check your app?

VibeRescue checks are coming soon. Join the waitlist, or ask StorenTech AI to fix it for you.

Join the waitlist

Vibe Security Weekly

One email a week with new failure patterns and how to fix them.

Signups open shortly. We'll never sell your email.