# Stripe webhook verification: internal regression report

Date: 8 September 2026
Scope: the verifyStripeSig function in the FBA Worker. Local synthetic messages only. No customer records or payment changes.

Result: 30 assertions passed. Cases include valid and invalid HMACs, missing and malformed headers, timestamp syntax and tolerance boundaries, duplicate timestamp rejection, multiple v1 signature ordering.

Two edge cases were reproduced in the previous source and corrected: a signed nonnumeric timestamp did not reliably enforce the age window, and only the last v1 signature was considered. The malformed timestamp case still required the signing secret; the test did not demonstrate an unsigned forgery.

Test command: node scripts/qa_stripe_signature.mjs
Hash convention: the async function declaration through its closing brace, followed by one newline.
Verified function SHA-256: 1b0367dc4c49b77cbc6502d991e9943a3119c5223e99fdaf24218931964c25f3

Limitations: internal automated regression tests, not an external audit or penetration test. They do not prove billing cancellation, race handling, account isolation or the security of the whole application. Billing-controller tests are a separate review.