xAI
AnthropicBased on real interviews
Spot the bugs: a webhook signature check
Review the code that decides whether a billing webhook can be trusted before an account receives credits.
Unlock with Full AccessThe challenge
A signature verifier sits between incoming billing requests and changes to an account's credits. Inspect the implementation for bugs that admit untrusted requests or reject valid ones. Explain what each issue allows or breaks, then describe the correction.
- Review the verifier
- Explain the bugs and fixes in the supplied code. You do not need to rewrite the webhook service.
What you'll practise
Signature verification
Follow how a request's signature is checked against the expected value.
Request trust
Identify paths where an invalid request can reach account-changing code.
Corrective reasoning
Explain how a fix rejects bad requests while preserving valid deliveries.
Webhook code reviewCode included in the full challenge
Your findings
Describe each verification bug, its effect and the proposed fix.
The code, instructions and feedback are included with Full Access.