fix: make stripe webhooks explicitly toggleable with mandatory secret validation

2026-04-17 19:13:16 +05:45
parent 87dcf53d74
commit c9f9e3d19f
11 changed files with 145 additions and 41 deletions
@@ -178,6 +178,7 @@ Notes:
 - Reads raw request body and `Stripe-Signature` header
 - Calls `billing.handle_webhook(payload, signature)`
 - Returns `200` on success, `400` on signature verification failure
+- Startup requires non-empty `STRIPE_WEBHOOK_SECRET`

 --- Utilities