603f444c33
Webhook routes were only registered in app.js (the test factory) but not in index.js (the production entry point). POST /api/webhook/* was therefore falling through to the verifyCsrf middleware and being rejected with 403 in production.