All packsTransactional Email Deliverability CoreSolve
svix webhook signature verification raw body nextjs route handler
Verify the signature before you look at the payload -- not after
A route that parses a webhook body before verifying its Svix signature can be tricked into doing database work on an unverified, possibly forged payload.
What goes wrong
If a webhook route parses the request body (to log it, to inspect the event type for routing) before checking its Svix signature, then an attacker who can reach the endpoint can send a forged payload that gets partially processed -- routed, logged, maybe used to decide which handler to call -- before the signature check ever runs and rejects it. The verification existing later in the function doesn't retroactively undo work already done on unverified input.
Why agents get it wrong
Parsing the body first, to decide what kind of event it is and log it usefully, is a natural way to structure a webhook handler for readability and debugging -- signature verification reads as a step to add somewhere in the function, not necessarily as the literal first line before anything else touches the payload's contents.
What Transactional Email Deliverability Core pre-decides
The pack pins verify-before-anything-else as a named contract: verifyAndParse() runs first, handleEvent() only runs on success, and a bad or missing signature returns 401 with zero database writes. The route handler deliberately uses only Web-standard Request/Response (no next/server import) specifically so it stays directly invokable by the test that acts as the security gate: verify.sh fails any build whose route parses before verifying.
Source: ARCHITECTURE.md 'Webhooks (Resend -> Svix transport)', decision 6-7