It could happen in other scenarios, if you generate incoming webhook URLs and don't treat them as secrets. Once you get your hands on one of those, you've got

It could happen in other scenarios, if you generate incoming webhook URLs and don't treat them as secrets. Once you get your hands on one of those, you've got a fair shot at a phishing attack.