Webhook on the storefront: where the widget posts
A callback in public JS is not a breach — until a token sits in the URL. One-minute check.
Payment or CRM widgets often embed the callback URL in the same JS every visitor can read.
Dangerous when the URL already has token= or a long secret in the path — then the secret is public.
Orb44 opens the public homepage, finds webhook/callback/ipn strings, and on same-host URLs does a safe GET plus empty POST {}. No forged business payloads.
Red: secret in URL or open 2xx. Amber: URL seen, no clear risk. Green: none on this homepage.
Check: orb44.com/webhook. Full snapshot in the cabinet.