A webhook registered without any authentication

Webhook sends outbound calls with no authentication.

A webhook with no key or header cannot prove its calls are genuine, so anyone who learns the URL can post traffic that looks authentic.

Check the authentication configuration on each registered webhook. Ones with no key and no authentication header are the finding. Worth pairing with a check at the receiving end, since a receiver that does not validate the header is the same exposure from the other side.

Add a header-based secret and require it at the receiver; rotate it periodically.

These mappings are indicative. Pathix detects a condition relevant to a control. It does not certify your compliance, and a finding is not an audit opinion. You stay responsible for your control environment.

• A credential stored in a plugin step's unsecure configuration
• A webhook or service endpoint using plaintext HTTP
• An HTTP-triggered flow anyone with the URL can run