If you' runnin an e-commerce site, attackers are getting free goods by completely bypassing Safaricom...
They just clone a fake "payment success" callback and ping your API directly.
If you aren't validating webhook signatures and whitelisting Safaricom's IPs, dead ...π