TIL: Sep 5

TIL: To prevent CWE-347 (Improper Verification of Cryptographic Signature) in payment webhooks, always fail closed if the HMAC secret is missing and enforce strict gateway order ID matching. Additionally, migrating from monolithic components to a micro-component architecture using custom hooks significantly improves testability and state management in complex forms like the TUS uploader.