Your webhook endpoint trusts strangers

Here is a real endpoint, lightly disguised, that I have seen more than once: app.post("/webhooks/stripe", express.json(), (req, res) => { const event = req.body; if (event.type === "checkout.sessi