[Motion Menu] "trust the hooks via 255" — payload signed client-side, verified server-side; flip one byte and watch it get rejected.
pnpm dlx shadcn@latest add "https://registry.directory/r/motion-menu/webhook-signatures.json"