A quick 30s scan of the webhooks docs looks like that is correct; if you used e.g. 12345 as your secret, you would be susceptible to a dictionary attack from anybody who was able to record a message, on the order of 10s of billions of keys per second can be tested with a multi-GPU setup.<p>I suspect that the web hooks typically run over TLS, so recording the plaintext of a request would be a challenge in and of itself.