I build systems that receive payment confirmations from Safaricom’s M-PESA Daraja API (STK Push and C2B callbacks). As far as I can tell, Daraja doesn’t send an HMAC signature or similar with its callbacks, unlike Stripe or GitHub webhooks, so the receiving endpoint can’t cryptographically verify that a callback really came from Safaricom.

Current mitigations I’m aware of or using:

• Allowlisting Safaricom’s published callback IP ranges
• A long random secret token in the callback URL path
• Treating the callback only as a hint, then confirming the payment with an outbound Transaction Status query before marking anything paid
• Idempotency on the transaction ID so replayed callbacks can’t double-credit

My specific question: is the outbound “confirm before trust” query enough on its own to treat inbound callbacks as untrusted, or are there attack paths I’m missing (e.g. race conditions between callback and confirmation, or manipulation of the confirmation response)? How do others handle unsigned webhooks from payment providers in production?

We're talking to vendors who keep pitching both, but I'm not sure if my company needs that because we're still a pretty small org. Can someone explain to me why we would budget for both, or if one would be preferable to the other?

Last year we brought on a tool to get runtime context on our workloads and help prioritize vulns, mostly to cut noise based on what’s actually loaded in memory. At the time it seemed like a no brainer, since direct exploitation or even chained attacks mostly can’t work against components just sitting on the filesystem.

We ran a threat modeling exercise the other day on some new systems running AI agents with tool access, and in some cases a shell. It got me thinking: can’t the agent load anything it needs at any point, unlike older deterministic code? And if so, doesn’t runtime context based prioritization fall apart completely?

Can anyone with practical experience in this area chime in? I’m at my wits end brainstorming hypotheticals with GPT.

Hi all, I'm trying to learn how infrastructure and network audits work in practice and would love some input from people doing this daily.
What are the control gaps you find most often?
Where do auditees tend to be weakest (patching, access reviews, firewall rules, logging)?
Any audit checklists you'd recommend