The webhooks allowed list was moved to the security part of the config file This is running on gitea-2