Webhook authenticity
A webhook is an authenticated call from another system, and the signature is what makes it authenticated. If the signature is optional, missing, or ignored when verification throws, the body is the only authority for the event.
Skill: Access control and tenant boundaries
Ask: Can account A read or change an object that belongs to account B, including a job, export, or leftover endpoint?
Stop: One object you own is denied to the other account, and one object you should not own is not returned.
Checklists
- Exports and webhooks - Exports and webhooks are delayed APIs. The job id, the file, and the callback URL each need an owner.
Disclosures
No public card yet.
Playbooks
- Exports and webhook authenticity - An export job and a webhook are both delayed authority. The job must stay bound to the account that created it. The webhook must fail when the signature is missing, and a signature check that throws must not fail open.
Tools
- Burp Suite - The industry-standard intercepting proxy for manual web testing. Community edition is free; Pro adds the active scanner and automation.
Questions
The endpoint has a signature header. Am I done?
Check the absent-header case, the empty-secret case, and the error path. Optional means the check runs only when the header is present, or not at all.
Is a replay worth recording?
If your own test event is accepted twice because no event id or timestamp is required, document that. Do not replay another customer's events. A URL fetch by a webhook tester belongs on the SSRF hunt, not here.
This page is the linked pack hunt_brief("webhook") returns on the MCP connector. Authorized testing only.