Thanks for the coverage! ^^

Re: security. As has been stated above, these POST requests don't rely on wp nonces or such at all. On the other hand, since HookPress can only display the response of the webhook, no additional damage can be done—you can't, for example, built a webhook which then instructs HookPress to clear the database or anything. Moreover, as you control which fields are being sent to the webhook, it is ulitmately up to the user to control its use and security.