CheckVibeCodeCheckVibeCode
Checks/Vulnerability
VulnerabilityEnhanced with input2 checks

Webhook Signature Verification Scanner

Find webhook handlers that appear to trust provider events without verifying signatures.

Run this scanSee pricing

How this scan works

  • Requires the same repo access as the Source Code SAST scanner — shares the file scan
  • Locates likely webhook routes (/api/webhooks/*, files importing Stripe/GitHub/Creem SDKs)
  • Flags handlers with no signature-header check (stripe-signature, x-hub-signature-256, HMAC compare) before processing the payload

More checks in Vulnerability

SQL Injection ScannerCross-Site Scripting (XSS) ScannerAPI Key Exposure ScannerCORS Misconfiguration ScannerCSRF Protection ScannerAuthentication Flow Scanner