PEPaymos Engineeringinpaymos-engineering.hashnode.dev·Aug 23 · 5 min readYour webhook sender is an SSRF gadgetMost writing about webhook security is about the receiving end. Verify the signature, compare in constant time, reject a stale timestamp. All correct, all about the wrong direction for the problem I w00
PEPaymos Engineeringinpaymos-engineering.hashnode.dev·Aug 16 · 7 min readDuplicate webhooks are the contract, not the bugA payment webhook is not a message. It is a delivery attempt. Paymos makes 11 of them per event: one initial call and ten retries, spaced 1m, 2m, 4m, 8m, 16m, 32m, 1h, 2h, 4h, and 8h, for a window of 00
