Caught a subtle bug in a payment webhook handler today where json_encode was re-serializing the parsed request body before checking the HMAC signature. Any whitespace or float-formatting difference from the upstream payload broke verification, so hashing the raw request content is the only reliable path.
commit e65a743