Oh no. I didn't run into that so I guess we'll get bug reports of webhooks not being validated in due course.

Here's a couple of my "favourites":
[CODE="php"] $state->requestKey = $state->resource['purchase_units'][0]['custom_id']
?? $state->resource['disputed_transactions'][0]['custom']
?? $state->resource['custom']
?? $state->resource['custom_id']
?? null;[/CODE]
Dude, I just want to get the "custom" field we passed in. Why are you like this?
[CODE="php"]case 'PAYMENT.SALE.REFUNDED':
case 'PAYMENT.CAPTURE.REFUNDED':
$status = $state->resource['state'] ?? $state->resource['status'];
if (strtoupper($status) === 'COMPLETED')[/CODE]
When is a status not a status? When it's a state? Two basically identical webhooks (though one for a straight sale, one for a recurring payment), but two different names for the "status".
