The double standard of webhook security and API security