Anyone can POST to your webhook
Orders are fulfilled from a payment-succeeded webhook. Someone guessed the URL, posted a crafted body, and received free goods. Separately, the warehouse occasionally ships an order twice.
Two different bugs with one diagram: nothing proves the request came from the provider, and nothing remembers whether this event was already handled.
Outside every boundary: Fulfilment (ships the order; FAILED: shipped for free), Anyone (guessed the URL), Payment provider, an empty slot for the before parsing, an empty slot for the before acting Connections: Payment provider calls before parsing — signed (step 1) Anyone must NOT reach before parsing — no valid signature before parsing calls before acting (step 2) before acting calls Fulfilment — once only (step 3)