BLOG · 2026-06-03
Anyone can trigger my webhook
Many automations have an entry point on the internet: a secret address that, when someone "calls" it, kicks off the process. It's called a webhook. The problem is that many of those doors have no lock: anyone who discovers the address can trigger your automation as many times as they like.
What a webhook is (no jargon)
Picture a doorbell. When someone presses it, something happens in your house: it rings, a light comes on, the door opens. A webhook is that for your automations: an internet address that, when it receives a call, triggers an action — create an order, send an email, record a payment.
It's wonderfully convenient: it lets your tools notify each other on their own. The danger is when that doorbell doesn't check who's pressing it.
The problem: a doorbell anyone can press
If your webhook accepts any call without verifying where it comes from, you're trusting that nobody discovers the address. That's a very bad idea, because:
- Addresses leak: they show up in logs, in shared code, in screenshots.
- Some people hunt for them on purpose, trying common addresses en masse.
- A single leaked address gives an attacker a button to fire your process at will.
"It's secret" is not a lock. It's hiding the key under the doormat.
What someone can do with your open webhook
- Fire it a thousand times. If your automation sends emails or uses a paid service, they can drain your credit or bombard your customers with mail.
- Slip in fake data. Create orders that don't exist, mark payments that never happened, inject junk into your database.
- Take down your system. Through mass calls, bring your automation (or the whole website) to its knees.
How the lock goes on
The good news: locking a webhook is relatively simple if it's done when you set it up.
- A secret signature. The calling service and your automation share a key. Every call arrives "signed," and if the signature doesn't match, it's ignored. Anyone without the key is locked out.
- A call limit. Even if the signature is correct, a cap prevents a flood of calls from taking you down.
- Check that the content makes sense. Even through a legitimate door, verify that what comes in is coherent before acting.
- No harm if repeated. Receiving the same call twice shouldn't charge twice (this ties into duplicates).
Why this is real security
An open webhook is one of those back doors nobody looks at until someone walks through it. It doesn't make the news like the big hacks, but it's one of the most convenient ways for an attacker to get into your processes. And many automations built in a hurry have it wide open without knowing.
When we build automations, every entry point carries its lock from day one: signature, call limit and a check on what comes in. Because leaving a webhook open is like having an automatic warehouse door that opens with any remote — sooner or later, someone tries theirs.