← All keys & policies
Key·app
Webhook secret
Tier 2 · MediumData
Why Tier 2
Grants nothing on GitHub. It lets someone forge events to the service that receives them, so its real tier is whatever that service does with an event, such as starting a deployment.
The shared secret used to check that incoming webhook payloads really came from GitHub.
Available on: Every setup. Source
Attack path
A leaked webhook secret lets an attacker forge signed payloads to the receiving service, which may trigger deployment or automation logic with fake event data the attacker chose.
Mitigations
- Rotate webhook secrets like any other credential
- Have receivers re-check state through the API instead of trusting payload contents
Detect
Alert on hook.config_changed, hook.create in the audit log.