Feature: clarify webhook disclaimer (#7339)

Author: gregfromstl

apps/portal/src/app/pay/webhooks/page.mdx

@@ -1,4 +1,4 @@
-import { createMetadata, DocImage } from "@doc";
+import { createMetadata, DocImage, Callout } from "@doc";
 import { Tabs, TabsList, TabsTrigger, TabsContent } from "@/components/ui/tabs";
 
 export const metadata = createMetadata({
@@ -9,6 +9,10 @@ export const metadata = createMetadata({
 
 # Webhooks
 
+<Callout variant="warning" title="Verify All Webhook Data Onchain">
+**When using webhooks to distribute purchased items, always verify that the proper amount was paid to the proper address onchain using the provided transaction hash. Do not make any assumptions regarding onchain data based on webhook payloads.**
+</Callout>
+
 You can create a webhook in your project dashboard under the Universal Bridge tab. You'll be prompted to copy a secret key before saving the webhook. This will be used for verification on all webhook requests received by your backend.
 
 ## Response Objects
@@ -120,4 +124,3 @@ The `x-timestamp` header is a UNIX timestamp in seconds, and the webhook body is
 
 Then verify that the signature matches the `x-payload-signature` header.
 
-**When using webhooks to distribute purchased items, always verify that the proper amount was paid to the proper address.**