security

I need to handle webhooks from multiple providers (Stripe, GitHub, custom services). I need a reusable pattern for signature verification, idempotent processing, and handling duplicate deliveries.

I need API key authentication for my FastAPI service. API keys must be stored securely (not plaintext), validated on every request, and I want to support multiple keys per user with revocation.

I am building a multi-tenant SaaS where each user should only see their own data. I want PostgreSQL row-level security (RLS) policies to enforce data isolation at the database level.

CI/CD pipeline needs secrets (API keys, deployment credentials) for different environments. Using repository-level secrets means production keys are accessible in all workflows including untrusted PRs...