# Webhook security best practices

The security checklist for webhook endpoints - verify signatures against raw bytes, bound timestamps, process idempotently, rotate secrets, and keep payloads out of your logs.