The secret is the gate, and it is rotatable
Each account gets its own webhook address, with a secret token in it. The token is compared in constant time, so a wrong guess cannot be narrowed down by timing how long the reply takes. Rotating the token invalidates the old address at once, which is what you do if one of your alerts ever ends up somewhere public.
Webhooks are off by default and stay off until you enable them. A URL that exists but is disabled does nothing, so turning one on is always a deliberate act.