A real sample report
This is the report the verification pipeline produced for a demo Stripe webhook endpoint — the same shape every buyer receives. The endpoint passed signature verification but accepted an expired timestamp, which is exactly the kind of quiet gap the suite exists to find.
https://demo.example.com/api/webhooks/stripeEndpoint passed core signature verification but failed 1 timestamp replay tolerance check.
- Valid Cryptographic SignaturePASS · HTTP 200 · 82ms
Endpoint accepted authentic signature with HTTP 200.
- Tampered Payload BodyPASS · HTTP 400 · 34ms
Endpoint securely rejected tampered payload with HTTP 400.
- Tampered Signature HeaderPASS · HTTP 400 · 29ms
Endpoint securely rejected invalid signature with HTTP 400.
- Expired Timestamp (Replay Tolerance)FAIL · HTTP 200 · 41ms
REPLAY RISK: Endpoint accepted timestamp from 15 minutes ago with HTTP 200. Replay attacks are possible.
Configure timestamp tolerance (default recommendation: 300 seconds / 5 minutes). In Stripe, pass tolerance: 300 to constructEvent.
- Future Timestamp (Clock Skew)PASS · HTTP 200 · 38ms
Endpoint answered HTTP 200 for future timestamp vector.
- Missing Signature HeaderPASS · HTTP 400 · 25ms
Endpoint rejected request with missing signature header (HTTP 400).
- Rapid Replay ConcurrencyPASS · HTTP 200 · 46ms
Endpoint handled duplicate event delivery gracefully with HTTP 200.
- Malformed JSON PayloadPASS · HTTP 400 · 22ms
Endpoint cleanly rejected malformed JSON with client error HTTP 400.