SECOPS
Discord Webhook Token Exposure Check
Searches your GitHub org for any Discord webhook URLs committed into source code, and pages on-call via PagerDuty when a live token is found exposed in a repository.
How it runs
The automated pipeline, trigger to output.
- TriggerDaily schedule fires
- ActionSearch GitHub org for webhook URL patternGitHub
- ActionVerify each webhook is live via DiscordDiscord
- LogicKeep only confirmed-active exposures
- OutputPage on-call via PagerDuty per live tokenPagerDuty
What it does
Discord webhook URLs embed a secret token; once one lands in a public or shared repo, anyone can post to your channel. This flow scans your GitHub organization for the `discord.com/api/webhooks/` pattern, confirms the webhook is still live, and escalates the active exposures.
When to use it
Run it when developers wire Discord notifications into apps and occasionally hardcode the webhook URL instead of using a secret. A daily scan turns a slow-burn leak into an immediate page before an attacker abuses the endpoint.
How it works
- 1A daily schedule starts the scan.
- 2A GitHub code search runs across all org repos for the Discord webhook URL pattern.
- 3For each match, the flow calls the webhook's metadata endpoint on Discord to check whether the token is still valid and which channel it targets.
- 4A logic step keeps only live, confirmed-active webhooks and discards dead or already-rotated ones.
- 5A PagerDuty incident is raised per live exposure with the repo path, file, and target channel so on-call can rotate it.
Set it up
What you configure once, before turning it on.
- 1Connect GitHubRepos, issues, pull requests, actions.
- 2Connect DiscordCommunity channels + voice + bots.
- 3Connect PagerDutyIncidents, on-call, escalations.
- 4Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
- 5Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
- 6Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.
More SecOps workflows
Post-Revocation Verification and Audit Logging
After a key is revoked, it confirms the old credential actually fails, verifies the replacement works.
Page on-call when a WAF rule mass-blocks legitimate traffic
On demand or every few minutes, it detects a single Cloudflare WAF rule suddenly blocking a broad spread of ASNs and paths (a likely false-positive storm).
PII Content Scan on New Dropbox External Share
When a file gets an external Dropbox link, it reads the file content, uses an AI classifier to detect PII or secrets.
Compile a weekly WAF tuning review with trends to Confluence
Every week an agent rolls up Cloudflare WAF block clusters by rule and ASN, compares them to prior weeks for trend direction.
Sensitive Dropbox Link Owner Remediation Loop
When a newly created Dropbox shared link points to a sensitive file, this workflow DMs the file owner, gives them a deadline to justify or revoke it.
GitLab Push Secret Detection to Block and History Purge
On a GitLab push that contains a detected secret, it revokes the exposed credential, opens a tracking issue with git-history purge instructions.
Run it inside a business
This workflow drops into a full company template. Import the org, and this is one of the playbooks its agents run.
Run this workflow in your colony.
14-day trial. No DevOps. No Sales call. Provisioned in under a minute.