I don’t recall the exact reasons, but probably we figured at the time that if you’re sharing secrets, then there’s no need to make the webhook team specific (because you don’t need to hide the details from them). But equally, you may not want others to mess with the webhook. I’ll put it in the backlog. It might be easy, or quite complicated - I’m not across that level of detail in the code!