The AxonFlow SDK versions 6.6.2 and below do not expose the HMAC-SHA256 signing key via the typed SDK API, preventing webhook receivers from verifying the authenticity of incoming webhook payloads. This allows an attacker who discovers the webhook URL to forge webhook deliveries that appear legitimate, potentially causing unauthorized actions in the receiving application. The issue is fixed in version 6.7.0, which exposes the signing key for proper signature verification.