projects / checkout / decisions
Webhook signing
Context
Two endpoints shared one secret, so rotating it broke both.
Decision
Each endpoint gets its own signing secret, stored in the secrets manager.
Consequences
Rotation is per endpoint. The runbook covers the order of steps.
