Just because your webhook endpoints aren't listed anywhere (are they?) doesn't mean someone won't find them, and send malicious payloads to your app! You need to validate your webhook payloads!
https://securinglaravel.com/security-tip-validate-your-webhooks/
#Laravel
