A webhook endpoint is a door you have left unlocked on the internet. The stranger walking through it is supposed to be a known partner, but the door does not know that. The verification is your job.
Sign payloads. Check signatures. Reject anything that does not match. Treat replays as hostile until proven otherwise. None of this is paranoia. It is the cost of opening a mailbox the public can write to.
Webhooks fail quietly when they fail. Build the alerting before you need it.
