diff --git a/server/billing.mjs b/server/billing.mjs
index 49ea83a..89e729a 100644
--- a/server/billing.mjs
+++ b/server/billing.mjs
@@ -114,7 +114,10 @@ export function verifyWebhook(hamGovde, imzaBasligi, { tolerans = 300 } = {}) {
   const b = Buffer.from(v1, 'utf8');
   if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) throw new Error('İmza doğrulanamadı');
 
-  return JSON.parse(hamGovde);
+  const olay = JSON.parse(hamGovde);
+  if (!olay || typeof olay !== 'object' || Array.isArray(olay) || typeof olay.type !== 'string' || !olay.type.trim())
+    throw new Error('Stripe webhook olay biçimi geçersiz');
+  return olay;
 }
 
 /** Stripe Price ID → plan kimliği */