The AxonFlow SDK for Go versions 5.6.1 and below did not expose the HMAC-SHA256 signing key via its typed API, preventing webhook receivers from verifying the authenticity of incoming webhook payloads. This flaw allowed attackers who discovered the webhook URL to forge webhook deliveries indistinguishable from legitimate ones, potentially causing unauthorized actions in the receiving application. The issue is fixed in version 5.7.0, which exposes the signing key for proper signature verification.