Webhook Exposure

Detects exposed webhook URLs with embedded tokens and secrets

5 rules in webhook_exposure.yml

CRITICAL: 1 | HIGH: 3 | MEDIUM: 1

Rule IDSeverityTitleDescriptionRefs
scim_endpoint_exposed_or_bearer_literalCRITICALSCIM Provisioning Endpoint Exposed Publicly Or Bearer-Token LiteralA task exposes a /scim/v2/* endpoint without an IP allowlist / mutual-TLS / WAF rule, or hard-codes the SCIM bearer token (Authorization: Bearer ... literal, scim_token: eyJ...). SCIM is the identity-sync firehose - a compromised SCIM endpoint lets an attacker provision admin accounts, disable MFA factors, and reset passwords for every user the IdP manages.
CWE-287T1098.005A07:2021V6.2.1AC-3CIS-6.1
discord_webhook_urlHIGHDiscord Webhook URL with Tokendiscord(app).com/api/webhooks// is embedded in source. The token gives unrestricted post-as-the-bot access until rotated via the Discord server settings.
CWE-532T1552.001A07:2021V13.2.3AC-3CIS-3.3
slack_webhook_urlHIGHSlack Webhook URL with Tokenhooks.slack.com/services///<24-char-secret> is embedded in source. Anyone with the URL can post messages as the bot, which is enough for phishing or social engineering.
CWE-532T1552.001A07:2021V13.2.3AC-3CIS-3.3
teams_webhook_urlHIGHMicrosoft Teams Webhook URLMicrosoft Teams webhook URL contains embedded authentication
CWE-532T1552.001A07:2021V13.2.3AC-3CIS-3.3
generic_webhook_with_tokenMEDIUMGeneric Webhook URL with TokenAn arbitrary webhook URL carries a ?token= / ?secret= / ?key= query parameter with a 10+ char value. The credential is in clear text in any logs that record the URL.
CWE-532T1552.001A07:2021V13.2.3AC-3CIS-3.3