Skip to main content
Back to challenges
Challenge

Secure Embedded Payment Webhooks with Claude Agents SDK

Embedded payment API integrations suffer from webhook spoofing and payload tampering vulnerabilities. Implement a Claude Agents SDK security agent that validates HMAC signatures and parses complex payload events with automated anomaly detection.

CybersecurityHosted by Vera
Sign in free to start
Challenge brief

What you are building

The core problem, expected build, and operating context for this challenge.

Build an embedded payment security agent using Claude Agents SDK to inspect API payloads and verify cryptographically signed webhooks.

Delivery guide

How work is evaluated

Evaluation

Tests webhook authentication and tampering detection against malicious payload samples.

Datasets

Challenge datasets

Public datasets, plus the private datasets you have access to.

Evaluation rubric

How submissions are scored

These dimensions define what the evaluator checks and which criteria separate a passable run from a strong one.

Dimensions
2 scoring checks
Binary
2 pass or fail dimensions
Ordinal
0 scaled dimensions
Dimension 1

Invalid Signature Block Test

Webhook with invalid signature must yield is_valid == False.

Binary check

This dimension contributes its full weight only when the submission satisfies the requirement. Partial credit is not awarded.

Dimension 2

Signature Validation Precision

Precision of detecting fake or tampered signatures. • target: 1 • range: 0.99-1

Binary check

This dimension contributes its full weight only when the submission satisfies the requirement. Partial credit is not awarded.

Learning goals

What you should walk away with

  • Construct a Claude Agents SDK workflow that validates incoming webhook headers and HMAC-SHA256 signatures.

  • Detect payload tampering, replay attacks, and field-level parameter injection.

  • Integrate automated API incident response routing for compromised webhook endpoints.

  • Ensure 0% unauthenticated payment execution rate.

Resources and assets

Reference links and supporting material

Dataset notes

Synthetic API webhook traffic logs containing authentic, tampered, and replayed payment events.

Challenge setup

Tests webhook authentication and tampering detection against malicious payload samples.

Challenge input

JSON containing request_headers, body_raw, secret_key

Claude Agents SDK

Provides robust structured parsing of security events.

Evaluated output

JSON with is_valid (boolean), security_flag ('TAMPERED', 'REPLAY', 'AUTHENTIC')

Evaluation checks
  • Webhook with invalid signature must yield is_valid == False.
  • Precision of detecting fake or tampered signatures. • target: 1 • range: 0.99-1
Configured evaluation evidence
  • Benchmark: WebhookSecurityBench
  • Signature Validation Precision target: 1
  • 1 public reference case
Configured runtime
  • Python execution harness
  • Python sandbox (unavailable on Versalist)

Summary shows the first task, up to three tools, and up to three evidence items. Open the technical recipe to view all configured items.

View technical recipe

Configured tools

Action Space
  • Claude Code · Required
Observation
  • Claude Code · Required
Policy Serving
  • Claude 4.1 Opus · Optional
  • Claude 4 Sonnet · Optional

Evaluation contract

  • Invalid Signature Block Test · Weight 1
  • Signature Validation Precision · Weight 1

Metrics

  • Signature Validation Precision · Target 1

Benchmarks

  • WebhookSecurityBench
  • security

Reference cases

  • 1 public reference case

Workflow tasks

  1. Task 1

    Input: JSON containing request_headers, body_raw, secret_key

    Output: JSON with is_valid (boolean), security_flag ('TAMPERED', 'REPLAY', 'AUTHENTIC')

    Execution harness: Python

Evaluation tools

  • Claude Agents SDK · Agent Framework

Recipe freeze marker

No recipe freeze time is recorded.

Frequently Asked Questions about Secure Embedded Payment Webhooks with Claude Agents SDK