A small project I built last year sent notifications to a Discord channel whenever something important happened, a new signup, a payment, an error worth knowing about. Getting that working took about ten minutes: generate a webhook URL in Discord's settings, paste it into my app's config, done. It worked immediately and I moved on.
The part I didn't think about at all
A webhook URL isn't like most links. Anyone who has it can post messages into that channel, and depending on how the receiving side is set up, sometimes trigger other things downstream. It's a credential, functionally, even though it looks like an ordinary link and doesn't come with any of the visual cues that usually make me think twice, no "secret" in the name, no obvious warning.
A few months in, I was debugging something unrelated and shared my screen on a call, with my code editor open, the webhook URL sitting in plain view in a config file for a good ten minutes while we talked through something else entirely. I didn't think about it once during that call. It wasn't until much later, reading through an old file, that I even remembered it had been visible.
What I found when I actually checked
Six months after that call, I finally thought to ask: is this specific URL still active, and would I even know if someone else had it. The answer to the first question was yes, unchanged since the day I created it. The answer to the second was no, I had no way to know. Nothing logs who posts to a webhook. If someone had grabbed that URL off my screen that day, they could have been quietly sending messages into my private channel for six months and I would have had zero indication, unless they'd done something loud enough to notice.
Why this category of leak is so easy to miss
A database key or a payment secret gets treated with real caution, because everyone's been warned about those specifically. A webhook URL rarely gets the same treatment, because it doesn't look dangerous and the damage it enables isn't always dramatic. But once it's out, it behaves exactly like any other leaked credential: usable by anyone who has it, until it's rotated, with no built-in expiration and often no logging to tell you it's being used.
What I do differently now
- Treat any URL that lets something happen, not just something be viewed, as a secret, regardless of what it looks like.
- Close unrelated tabs and files before sharing a screen, rather than trusting myself to remember what's visible in the moment.
- Rotate a webhook URL the same way I'd rotate an API key if it was ever visible somewhere I don't fully control, screen share, screenshot, support ticket, anywhere.
- Check, on any integration I set up more than a few months ago, whether it's still something I actually use, and remove or rotate the ones I've forgotten about entirely.
Nothing bad came of mine, as far as I can tell, though I'll admit there's no real way to be fully certain of that after the fact. What stuck with me is how invisible the whole category was until I went looking. A leaked webhook doesn't look like a security incident. It just looks like a link, right up until it's the reason something you didn't expect starts happening in a channel you thought was private.