Popular Webhook Deduplication Pattern Has a Silent Data-Loss Bug

A widely copied webhook deduplication technique using SQL's INSERT ON CONFLICT DO NOTHING contains a critical flaw that can silently drop events. The pattern claims a processed-event key before executing the actual work, meaning a process crash between those two steps leaves the key marked as handled while the work never runs. Because webhook providers like Stripe and GitHub use at-least-once delivery and retry for days, duplicates are a normal occurrence that handlers must safely absorb. The failure is especially dangerous because it produces no error, no alert, and no retry — the event simply disappears until a customer reports a problem. The fix is straightforward: wrapping both the claim insert and the business logic in a single database transaction so a crash rolls back both, allowing the next retry to succeed cleanly.