GHSA-xff3-5c9p-2mr4: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud

A critical vulnerability allows attackers to forge Stripe webhook events (messages confirming payments) and illegally credit their accounts with quota without paying, because the system uses an empty default secret key and doesn't verify which payment method was actually used. Three compounding flaws enable this: the webhook handler accepts empty secrets, signature verification can be bypassed with an empty key, and the system fulfills orders from any payment gateway when it receives a forged Stripe webhook.