The AxonFlow SDK versions 5.6.0 and below do not expose the HMAC-SHA256 signing key in the typed API for webhook subscriptions. This prevents callers from verifying the authenticity of incoming webhook payloads using the X-AxonFlow-Signature header. Without this verification, attackers who discover the webhook URL can forge webhook deliveries that appear legitimate, potentially causing unauthorized actions in the receiving application. The issue is fixed in version 6.0.0, where the signing key is exposed and can be used to verify webhook signatures properly.