You already found one. Let's check for the rest.
The same “trust req.body without verifying signatures” pattern can show up anywhere you accept a webhook: Stripe, Clerk, GitHub, Resend, SendGrid, Slack, Twilio. XploitScan checks for this pattern across the providers listed below.
The pattern, simplified
AI coding tools generate the happy path. You ask for “add Stripe payments” or “set up Clerk webhook” and you get a working handler that readsreq.body, checksevent.type, and does the thing.
What the generator skips: verifying the signature header against the payload with the webhook secret. Without that check, an attacker just needs to know the URL and can send you whatever event they want.
The attack is a single curl command. Real payments work fine, your dashboard looks fine, and you don't notice until someone on Reddit writes about it or your margins cave in.
Providers we check signature verification for
Stripe
signature verified?
Clerk
signature verified?
GitHub
signature verified?
Resend
signature verified?
SendGrid
signature verified?
Slack
signature verified?
Twilio
signature verified?
Stripe is checked on every plan. The others are checked on paid plans, in Next.js route handlers (an exported POST in a file under a webhook path).
If you're using a provider we don't yet cover, email us and we'll look at adding it.
The fix is usually 4 lines
For Stripe it's stripe.webhooks.constructEvent(rawBody, signature, secret) wrapped in a try/catch that returns 400 on failure, plus switching from express.json() to express.raw(). XploitScan shows a suggested fix for each vulnerable handler it finds. For Stripe it names the constructEvent call.
Scan your webhook handlers now
Free, no signup: paste a webhook handler into the demo, or run npx xploitscan@latest scan . on your repo. The free rules check Stripe webhooks; the other providers (Next.js route handlers) are checked on paid plans.