Webhook security

app.post("/webhooks/verify-group", express.raw({ type: "application/json" }), (req, res) => {
  const sig = req.headers["x-vg-signature-256"] as string;
  if (!verify(req.body.toString(), sig, process.env.VG_WEBHOOK_SECRET!)) {
    return res.status(401).json({ error: "Invalid signature" });
  }
  const event = JSON.parse(req.body.toString());
  // handle event...
  res.status(200).json({ received: true });
});