Outbound webhooks are protected on both ends of delivery.
- Destinations must be public HTTPS endpoints; private targets are blocked.
- Each request can be signed with HMAC-SHA256 so you can verify it.
- The signed input includes a timestamp so you can reject replays.
Verify signatures on your side: Verify webhook signatures.