Find risky n8n webhooks before they go public.

Webhook URLs are not hardcoded into public documentation unless intended. Production webhooks use authentication, signed payloads, or upstream filtering. Test and production webhook paths are clearly separated. Webhook responses do not expose stack traces, tokens, or customer data. Unknown methods are rejected instead of silently accepted. Webhook nodes are followed by validation before external actions run. Error branches handle duplicate or malformed submissions. Rate limits or upstream protection are documented for high-volume use.