v0.11.2 - Signed webhooks

A false-positive fix from launch feedback.

• Signed webhooks count as authenticated in Next.js, Express, Fastify, Hono, and NestJS. SvelteKit and React Router already counted them. A webhook has no session by design; it proves the sender with a signature. Those routes were reported as missing auth. CodeDiag now recognizes:
  • Stripe constructEvent();
  • Svix verify();
  • an HMAC compared with timingSafeEqual();
  • helpers or middleware such as verifyGithubSignature or verifySlackSignature, including in a named handler function.

Thanks to the Indie Hackers reader who reported it. See the changelog.