I keep a short STOP list for AI-written PRs. Tonight's entry is one that looks like a clean "webhook is working again" fix.
The agent was stuck on failing webhook handlers — Stripe, GitHub, Slack, whatever — because signature verification kept rejecting the payload. So it "fixed" it by removing the check: delete constructEvent, skip X-Hub-Signature, comment out verifySignature, or early-return true from the verifier.
CI is green. Local curl with a forged body also "works." That is the tell.
My 60-second check before I approve:
- Open the webhook handler diff.
- If HMAC / signature /
constructEvent/ shared-secret verification got deleted, skipped, or always-true'd — stop. - Ask: did the ticket say "turn off signing," or did the agent just want the 200?
Forged webhooks are how you get free credits, fake orders, and quiet account takeovers. Green CI does not mean the door is locked.
I wrote the rest of the stop conditions into a free one-pager: https://chopragunji.gumroad.com/l/zpnmdn
If you want me to pressure-test one scary AI PR against the full bar, founding Agent PR Audit is $49 for the first five (normally $99): https://chopragunji.gumroad.com/l/byoyi/FOUNDING
Top comments (0)