Most webhook security guides protect the wrong side. The scary part is delivery.

Everyone secures webhook ingestion. Almost nobody talks about SSRF via the delivery worker. I've been staring at webhook architectures for years, and the security conversation is almost always backwards. We obsess over verifying inbound payloads while leaving the outbound side wide open. Why Your HMAC Doesn't Save You Here HMAC verification only protects ingestion, not outbound delivery to tenant URLs. That signature proves the payload came from who it claims. Great. But your delivery worker — t