Document IPs for Webhook calls

[skip ci]

diff --git a/server/sonar-docs/src/pages/security.md b/server/sonar-docs/src/pages/security.md
index 395d1a85644f6a771e627f054034539aacb9ac70..1ec4590eb9c9df3af2f8ff08d777eafcd558245b 100644 (file)
--- a/server/sonar-docs/src/pages/security.md
+++ b/server/sonar-docs/src/pages/security.md
@@ -38,6 +38,18 @@ All communications are done over TLS 1.2:
 * Using WS APIs
 * Running analysis (by the scanners) from CI services and pushing analysis reports to SonarCloud
 
+## SonarCloud Webhook IPs
+
+SonarCloud performs webhook calls from the following list of IPs:
+```
+52.59.209.17
+52.59.246.1
+54.93.180.144
+18.194.44.125
+18.194.244.158
+18.195.64.198
+```
+
 ## Authentication
 
 Primary authentication on the system is available only through OAuth authentication with GitHub, Bitbucket Cloud and Microsoft VSTS. As a consequence, users don’t have a password on SonarCloud, and are as protected as what they expect (especially with 2FA activated on those systems).