Безопасная обработка платёжных webhook-уведомлений

security

payment-callback-safety is a Claude Code skill that enforces secure handling of payment callbacks and webhook notifications from WeChat Pay, Alipay, and similar platforms. It addresses five concrete failure patterns: skipping platform signature verification before decrypting the request body; missing replay-attack protection (5-minute timestamp window, transaction_id deduplication, order state machine); trusting the callback amount without comparing it to the locally stored order amount; divergent validation logic between the callback path and manual reconciliation flows; and placeholder TODO implementations that return fake success data instead of failing explicitly. The skill is aimed at backend engineers integrating third-party payment gateways who need to prevent forged notifications, replay attacks, and amount mismatches in payment reconciliation.