# Ensure Enforce Security Controls for All Webhooks

- Source: https://support.icompaas.com/support/solutions/articles/62000235295-ensure-enforce-security-controls-for-all-webhooks
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS GitHub Benchmark v1.0.0](https://support.icompaas.com/support/solutions/62000112695) › [CIS GitHub Benchmark v1.0.0](https://support.icompaas.com/support/solutions/folders/62000169264)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability:** **Level 1**

**Description**:  
 All webhooks integrated with repositories or systems must be secured to prevent unauthorized access and malicious payloads. Security measures include validating webhook signatures, using secret tokens, restricting IP ranges, and enforcing HTTPS communication to ensure that only trusted sources can trigger webhook events.

**Rationale**:  
 Using secured webhooks mitigates risks of code injection, unauthorized automation triggers, and supply chain attacks. It preserves the integrity and confidentiality of automated workflows and supports compliance with security best practices.

**Impact:  
** **Pros**:

-   Protects CI/CD and integration pipelines from unauthorized access.  
      
    
-   Prevents exploitation through malicious webhook payloads.  
      
    
-   Enhances overall security posture of development workflows.  
      
    
-   Supports audit and compliance requirements.  
      
    

**Cons**:

-   Requires additional configuration and maintenance effort.  
      
    
-   May introduce complexity in setting up integrations.  
      
    

**Default value:  
** Many webhook implementations allow unsecured or unauthenticated requests by default, increasing risk exposure.

**Audit**:  
 Review webhook configurations for signature validation, secret tokens, IP restrictions, and use of HTTPS. Test webhook endpoints for proper authentication and error handling.

**Remediation:  
** Implement webhook security features such as HMAC signature verification and IP whitelisting. Ensure all webhook traffic uses TLS encryption. Train developers and administrators on secure webhook practices.

**References**:

1.   [https://docs.github.com/en/developers/webhooks-and-events/webhooks/securing-your-webhooks](https://docs.github.com/en/developers/webhooks-and-events/webhooks/securing-your-webhooks)
    
2.   [https://docs.gitlab.com/ee/user/project/integrations/webhooks.html#secure-webhooks](https://docs.gitlab.com/ee/user/project/integrations/webhooks.html#secure-webhooks)
    
3.   [https://owasp.org/www-project-secure-headers/#webhooks](https://owasp.org/www-project-secure-headers/#webhooks)
    
4.   [https://www.cisecurity.org/controls/application-software-security/](https://www.cisecurity.org/controls/application-software-security/)
    

Tags:  
 ### # #

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.