Webhooks can now be signed, so your server can verify that each request genuinely came from Zonka Feedback and wasn't altered in transit.
Every signed webhook carries an HMAC-SHA256 signature in a Zonka-Signature header, generated from a secret unique to that webhook. Your server recomputes the signature and rejects anything that doesn't match.
Turn it on from Settings → Developers → Webhooks. It's on by default for new webhooks, and existing ones are unchanged until you enable it.
Setup steps, the header reference, and verification samples in Node.js, Python and PHP: