intermediate · review
The Payment Event That Was Never Signed
Orders become paid without matching provider records.
Evidence
POST /webhooks/payment 200 signature=missing event_id=reused-14
Investigate
Inspect Signature verification
Handler trusts a hidden URL.
Inspect Idempotency
Event IDs are not stored.