policy name: organization_webhook_no_secret
severity: LOW
Webhooks are not configured with a shared secret to validate the origin and content of the request. This could allow your webhook to be triggered by any bad actor with the URL.
Not using a webhook secret makes the service receiving the webhook unable to determine the authenticity of the request. This allows attackers to masquerade as your organization, potentially creating an unstable or insecure state in other systems.