Securing integrations: keys and webhooks

Each integration adds attack surface: API keys, webhooks, OAuth tokens. Protect secrets, scope keys narrowly, rotate regularly, and verify webhook signatures.