Provide public documentation and access to /hooks API (webhooks)

Yes, I agree. In fact, that's a security concern I hadn't even considered previously. Having rogue webhooks that you have no control over.