## Securing your webhooks
-After you've configured your server to receive payloads, you want to be sure that the payloads you receive are initiated by {instance} and not by hackers. You can do this by validating a hash signature that ensures that requests originate from {instance}.
+After you've configured your server to receive payloads, you want to be sure that the payloads you receive are initiated by {instance} and not by attackers. You can do this by validating a hash signature that ensures that requests originate from {instance}.
### Setting your secret
If the answer is "yes", then it's a Bug rule.
If not...
-**Is the rule about code that could be exploited by a hacker?**
+**Is the rule about code that could be exploited by an attacker?**
If so, then it's a Vulnerability rule.
If not...
### Vulnerabilities
Impact: **Could the exploitation of the Worst Thing result in significant damage to your assets or your users?**
-Likelihood: **What is the probability that a hacker will be able to exploit the Worst Thing?**
+Likelihood: **What is the probability that an attacker will be able to exploit the Worst Thing?**
### Security Hotspots
Security Hotspots are not assigned severities as it is unknown whether there is truly an underlying vulnerability until they are reviewed.