Signature verification at scale

Highlights

• Canonicalize payload consistently.
• Use constant-time compare for signatures.
• Enforce timestamp and nonce windows.

Tags: #webhooks #security #hmac