The Signing Bug You Cannot See Until a Tenant Tries to Verify You

A tenant registers a delivery callback URL. The Hub sends a POST whenever Resend reports an email bounced or was opened. The body is JSON. The header X-Hub-Signature carries an HMAC-SHA256 digest computed over that body using a secret that only the H...