Opus finding
Webhook list endpoint documented as Signed, contradicting `webhook list` CLI usage and norm
lowdocs-gapmedium
- gitlawb/references/api-reference.md:84-88
- gitlawb/SKILL.md:197-201
Listing webhooks is described as `Signed`, which is reasonable since webhook URLs/secrets are sensitive — but neither SKILL.md nor the CLI reference notes that the caller must be the repo owner to list. If the server actually returns webhooks for any signed request (any DID), webhook URLs and event subscriptions for arbitrary repos would leak across users. The doc should make the ownership/authorization model explicit (e.g., 'Signed, repo owner only'). Without this clarification, integrators may build agents that expose other users' webhook configuration.
Recommendation
Update the Auth column to 'Signed (repo owner)' for the webhook GET/POST/DELETE rows, and add a short paragraph above the table describing authorization (signature identity must match `{owner}`).