# Push deployments always verify their signature

The signature of an incoming push was only checked when a secret had been stored. An application without one could trigger a deployment unverified.

> Security · 2026-09-12 · Applications, Platform

- The signature is now validated before any database access
- A database constraint makes the state of a repository without a secret impossible
- Existing secrets were rotated, so affected webhooks must be set up again