Claude-coauthored webhook code treated caller-supplied sender and chat_id fields as authenticated identity while request authentication was optional, allowing a remote caller to impersonate an allowlisted sender and steer message routing.

+    /// Port to listen on.+    pub port: u16,+    /// URL path to accept webhook requests on.+    pub path: String,+    /// Optional Bearer token for request authentication.+    /// When set, all requests must include a matching `Authorization: Bearer <token>` header.+    pub auth_token: Option<String>,+}++impl Default for WebhookChannelConfig {+    fn default() -> Self {+        Self {

++/// JSON body expected from webhook POST requests.+#[derive(Debug, Deserialize)]+struct WebhookPayload {

+    );+}++// Build and publish inbound message

+    /// Header carrying the request HMAC signature when `signature_secret` is set.+    #[serde(default = "default_webhook_signature_header")]+    pub signature_header: String,+    /// Server-controlled sender ID used when `trust_payload_identity` is disabled.+    #[serde(default)]+    pub sender_id: Option<String>,+    /// Optional server-controlled chat ID used when `trust_payload_identity` is disabled.+    /// Falls back to `sender_id` when omitted.+    #[serde(default)]+    pub chat_id: Option<String>,+    /// When true, accept caller-supplied `sender` and `chat_id` from webhook JSON.+    #[serde(default)]+    pub trust_payload_identity: bool,@@ -915,0 +936,5 @@ impl Default for WebhookConfig {+            signature_secret: None,

+                trust_payload_identity: webhook_config.trust_payload_identity,

+    pub signature_header: String,+    /// Server-controlled sender ID used when `trust_payload_identity` is disabled.+    pub sender_id: Option<String>,+    /// Optional server-controlled chat ID used when `trust_payload_identity` is disabled.+    /// Falls back to `sender_id` when omitted.+    pub chat_id: Option<String>,+    /// When true, accept caller-supplied `sender` and `chat_id` from the JSON payload.+    pub trust_payload_identity: bool,@@ -121,0 +161,5 @@ impl Default for WebhookChannelConfig {+            signature_secret: None,

+    }++    let sender_id = config+        .sender_id+        .as_deref()+        .map(str::trim)

+    Ok(())+}++fn resolve_identity(+    payload: &WebhookPayload,+    config: &WebhookChannelConfig,+) -> Result<(String, String)> {+    if config.trust_payload_identity {+        let sender = payload.sender.as_deref().map(str::trim).unwrap_or_default();+        let chat_id = payload+            .chat_id+            .as_deref()+            .map(str::trim)+            .unwrap_or_default();++        if sender.is_empty() || chat_id.is_empty() {+            return Err(ZeptoError::Channel(+                "message, sender, and chat_id must be non-empty".to_string(),+            ));+        }++        return Ok((sender.to_string(), chat_id.to_string()));+    }++    let sender = config+        .sender_id+        .as_deref()+        .map(str::trim)

+    let chat_id = config+        .chat_id+        .as_deref()+        .map(str::trim)+        .filter(|chat_id| !chat_id.is_empty())+        .unwrap_or(sender);++    Ok((sender.to_string(), chat_id.to_string()))+}

+                let body = format!("{{\"error\":\"{}\"}}", e);+                let response = format!(+                    "{}Content-Length: {}\r\n\r\n{}",+                    HTTP_400_BAD_REQUEST,+                    body.len(),+                    body+                );+                let _ = stream.write_all(response.as_bytes()).await;+                return;+            }+        };@@ -421,5 +582,2 @@ impl WebhookChannel {-        if !base_config.is_allowed(&payload.sender) {-            info!(

-            "webhook",-            payload.sender.trim(),-            payload.chat_id.trim(),-            payload.message.trim(),-        );+        let inbound = InboundMessage::new("webhook", &sender_id, &chat_id, payload.message.trim());

+