Wherever a webhook can be selected (triggers, schedulers), it is shown as Name (Endpoint). Many endpoints carry secrets in the path or query (e.g. Teams/Slack/chat webhooks), so the full secret is visible to every admin editing a trigger, and on screenshots and shared screens. Long URLs also make the selection hard to read (see #6500).
Proposal: show only the host of the endpoint.
File: app/assets/javascripts/app/models/webhook.coffee
Current:
displayName: ->
return @name if !@endpoint
if @active is false
return "#{@name} (#{@endpoint}) (#{App.i18n.translateInline('inactive')})"
"#{@name} (#{@endpoint})"
Suggested:
displayName: ->
return @name if !@endpoint
host = @endpointHost()
label = if host then "#{@name} (#{host})" else @name
if @active is false
return "#{label} (#{App.i18n.translateInline('inactive')})"
label
endpointHost: ->
try
new URL(@endpoint).host
catch
null
URL.host drops the scheme, path, query and any user:pass@ part. Endpoints with placeholders such as #{config.fqdn} may fail to parse and then fall back to the name only.