Manual webhook setup Github token

[daquinteroflex]

Hi,

I was curious when this manual webhook Github token was going to be implemented. Does this currently have an effect on security with manual configurations?

readthedocs.org/docs/user/guides/setup/git-repo-manual.rst

Line 58 in 6410aa0

.. note:: The webhook token, intended for the GitHub **Secret** field, is not yet implemented.

Cheers,
Dario

[daquinteroflex]

I've tried this. From what I can gather, is that until the token gets implemented for verification. Say, we won't be able to have an external API or even Github from a different user or organization, triggering the .readthedocs.yaml build for the particular repository that is loaded as part of the owner organization?

[stsewd]

Hi @daquinteroflex thanks for bringing this to our attention, we will be changing this, so integrations are always created with a secret. We will post an update about this early next week.

[stsewd]

We decided to do a security release, since abusing webhooks without a secret could be a problem https://blog.readthedocs.com/security-update-on-incoming-webhooks/. Thanks again for bringing this issue to our attention!