chore: Wire up or remove unused WEBHOOK_SIGNING_SECRET env var

[dotunv]

Overview

Wire up or remove the WEBHOOK_SIGNING_SECRET environment variable, which is documented in .env.example and README but reads nothing in the codebase.

Motivation

Per ASSUMPTIONS.md item 4, WEBHOOK_SIGNING_SECRET "is read by nothing in the codebase" — it's documented but unused. This causes confusion: operators may set a secret expecting webhook signatures to be validated, when in fact there is no signing component at all. This is a documentation/hygiene gap that could lead to a false sense of security.

Proposed Design

Two options:

Option A (preferred): Wire it up. Implement webhook signing so the secret is actually used:

1. Add a signature header (X-Savitura-Signature) to outbound webhooks using HMAC-SHA256 of the body with WEBHOOK_SIGNING_SECRET
2. Add a GET endpoint to introspect whether signing is enabled
3. Document how consumers can verify signatures

Option B: Remove it. If signing is out of scope:

1. Remove WEBHOOK_SIGNING_SECRET from .env.example
2. Remove from README/env table
3. Remove from ASSUMPTIONS.md item 4
4. Add a note that webhook signing is not yet implemented

Acceptance Criteria

For Option A:

• Outbound webhooks include X-Savitura-Signature header using HMAC-SHA256
• Verification utility exists with tests
• Signature uses body bytes with canonical timestamp to prevent replay
• Documentation updated with verification instructions

For Option B:

• WEBHOOK_SIGNING_SECRET removed from .env.example
• Removed from README env table
• ASSUMPTIONS.md item 4 updated to note signing is not implemented
• No references remain in the codebase

[CollinsKRO]

@CollinsKRO has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi, I can fix this kindly assign.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @CollinsKRO to this issue.

[Peaostrel]

@Peaostrel has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

i can handle this quickly

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Peaostrel to this issue.

[Morrison26-gif]

@Morrison26-gif has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi , I’ve carefully reviewed this issue and understand what needs to be fixed. I’m confident I can implement a clean solution that meets the acceptance criteria. Kindly consider assigning it to me

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Morrison26-gif to this issue.

[GazzyLee]

@GazzyLee has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

gm gm boss, I'd love to take this on, ETA is in 4 hours tops, please assign

ℹ️ Repo Maintainers: To accept this application, review their application or assign @GazzyLee to this issue.

[ndyugwu]

@ndyugwu has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

i would like to work on this kindly assign me

ℹ️ Repo Maintainers: To accept this application, review their application or assign @ndyugwu to this issue.

[alaminharuna-dev]

@alaminharuna-dev has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi Maintainer, I’ve gone through the issue and believe I can take it from investigation through implementation. I’d be glad to contribute.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @alaminharuna-dev to this issue.

[kathy-ai-art]

@kathy-ai-art has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hello maintainer, please assign

ℹ️ Repo Maintainers: To accept this application, review their application or assign @kathy-ai-art to this issue.

[drips-wave]

Congratulations, @kathy-ai-art! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on August 31, 2026.

🧑‍💻 @kathy-ai-art: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊