v1.1 - Security Hardening Update
Security Improvements
- Enforced HMAC Signature Validation - Webhook requests now REQUIRE valid signatures
- Duplicate Payment Protection - Prevents double payments via transaction ID check
- Invoice Validation - Verifies invoice exists before processing payments
- API Key Protection - Hidden in admin panel (password field)
- Rate Limiting - 60 requests/minute on webhook endpoint
Bug Fixes
- Improved error messages for Beam API failures
- Better logging for debugging payment issues
Requirements
- Webhook Secret (HMAC Key) is now REQUIRED in settings
