Function verify_signature 

fn verify_signature(app_secret: &str, body: &[u8], header: &str) -> bool

Validates X-Hub-Signature-256: sha256=<hex> = HMAC-SHA256(app_secret, raw_body). Uses Mac::verify_slice, which performs a constant-time comparison internally (backed by the subtle crate, already present transitively via hmac in this workspace’s dependency graph — no new crate added).