SAMPLE EVIDENCE for PM-01 (made-up app Tidyhaus; not a real review)

supabase/functions/stripe-webhook/index.ts, lines 14-21:
  const sig = req.headers.get('stripe-signature');
  const raw = await req.text();
  event = await stripe.webhooks.constructEventAsync(raw, sig, Deno.env.get('STRIPE_WEBHOOK_SECRET'));