Glossary
Webhook
A webhook is an inbound request one system sends to another, typically to report that some event occurred elsewhere. From the receiving system's point of view, a webhook is indistinguishable from any other unsolicited inbound request unless the sender is verified — usually through a shared signing secret used to sign the payload, which the receiver checks before treating the event as genuine.
A receiver that processes webhook payloads without verifying their signature is trusting the network path alone, which is exactly the assumption zero-trust design sets out to remove: anyone who can reach the endpoint can claim to be the legitimate sender.