Currently, GitHub gates validate incoming payloads when and only when:

• the gate is declared in credentials.json
• a secret is given

In all other case, you can flood the server with payloads for unknown doors.

This could or could not be an issue depending of the configuration:

• if the notifications center is on an internal network to communicate only between hosted tools, it's fairly safe
• if the notifications center must accept payloads from services like Docker Hub or GitHub, we should provide antiflood protection

Each service could get one or more key (to allow several sources to target the same gate/door). Constraints should be by gate and door.

For example we could have: