Indeed, in the end Troy disabled a certain rule for incoming requests from Stripe but not all. Just before publishing the article he discovered more (webhook) requests being blocked by a different rule. This seems like a continuous source of issues where valid (webhook) requests are being (arbitrarily) blocked. Why wouldn't you just disable all rules for requests coming from Stripe?