TLDR Tech / InfoSec
We probed 6,000 web apps for Stripe webhook signature checks. 1,542 don't bother
A scan of about 6,000 Stripe-style webhook endpoints sent a fake checkout.session.completed event with no Stripe-Signature header and logged which servers still returned 2xx. Around 1,542 endpoints did so, meaning they handle unsigned payment events that appear real. Many SaaS flows upgrade users or confirm bookings directly from webhook payload fields, allowing attackers to script free-plan upgrades or unpaid reservations with crafted JSON. The fix is to enforce official webhook signature verification using raw request bodies and stack-specific SDK helpers, then rerun targeted scans to confirm the behavior.
Read the full story