Webhook URL is not allowed

A malicious actor may attempt to access the code permanently by implementing a webhook.

This detector performs an inventory of the webhooks invoked from SCM and CI/ CD systems and check them against a white list provided by the customer.

After successfully compromising a user’s account, a malicious actor may attempt to access the code permanently by implementing a webhook

Review the webhooks invoked from your organization projects and remove those that are not allowed in your internal security policy.

The detector has a property allowedWebhooks where the user have to configure the allowed webhooks for her/ his organization.