#slack

Secrets

Slack & Discord webhooks: the 'harmless' URLs that are not

A webhook URL feels like just a link, so it ends up committed and shipped to the browser. But that link is the credential — whoever holds it can post into your channel.