Webhook signing

1. Each generic webhook delivery includes X-ErrorNotifier-Signature.
2. The signature format is t=<unix>,v1=<hmac-sha256>.
3. Verify the HMAC over "<timestamp>.<raw body>" using the webhook secret.
4. Reject stale timestamps and never trust unsigned payloads.
5. Use the incident_id and event_id fields for idempotency so retries do not create duplicate downstream tickets.
6. Replay prevention: store recently seen timestamp/signature or event_id values for your chosen tolerance window.
7. Security note: keep webhook secrets out of client code, browser logs, and issue comments.

Payload example:
{"event":"incident.opened","incident_id":42,"status":"open","severity":"critical","site":{"name":"Checkout","url":"https://example.com/health"},"summary":"HTTP 500 confirmed","occurred_at":"2026-05-22T16:30:00Z"}

Verification:
expected = hmac_sha256(timestamp + "." + raw_body, webhook_secret)