Secrets — Webhooks & Signed URLs

Slack/Teams/Discord webhook URLs and signed URLs with embedded secrets.

All rules in this category are kind secrets. They run under vulnetix secrets and the secrets stage of vulnetix scan.

Rule IDNameSeverityDetection
VNX-SEC-099Zapier webhook URLHighkeyword + regex
VNX-SEC-180Cloudflare Workers / Pages deploy webhook URLMediumkeyword + regex
VNX-SEC-417Discord webhook URLHighkeyword + regex
VNX-SEC-457Microsoft Teams incoming webhook URL (Power Automate)Highkeyword + regex

Remediation

Rotate any exposed credential immediately, remove it from source, and load it from a secrets manager or environment variable instead. Purge it from git history with git filter-repo. See CWE-798 and the OWASP Secrets Management Cheat Sheet.