When eventTypeId is provided, the query omits any filter based on userId or team membership, allowing the caller to fetch webhooks that belong to other users or teams. This breaks access control and can expose private data.

user?.teams may be undefined when the user is not found, causing .map to be called on undefined and throw at runtime. Use optional chaining or a fallback empty array before mapping.

unstable_cache is instantiated inside getCachedWebhook on every call, so caching cannot persist between calls because a new cache instance is created each time and no explicit cache key is provided; this largely defeats the purpose of caching and wastes memory.

unnecessary nesting

Wouldn't we want to only revalidate cache of only a particular webhook? We cannot pass id directly to tags when using unstable_cache, so we need to wrap it

await

fixed

Passing undefined as the keyParts argument means a new cached function (and therefore a new cache entry) is created every time getCachedWebhook is called, which largely negates the purpose of unstable_cache. Provide a stable key (e.g. the webhook id) or hoist the cached function outside the wrapper so that the same cache entry is reused.

Passing undefined as the keyParts argument means a new cached function (and therefore a new cache entry) is created every time getCachedWebhook is called, which largely negates the purpose of unstable_cache. Provide a stable key (e.g. the webhook id) or hoist the cached function outside the wrapper so that the same cache entry is reused.

user can be null when the lookup fails, causing in: undefined and a Prisma runtime error. Provide a fallback array or ensure the user exists before constructing the filter.

Selecting the entire teams relation fetches all membership fields and nested team data even though only teamId is subsequently used. This increases query payload size and may expose unnecessary data.