diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4d9510fe45..7f3b01baf7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,6 +16,7 @@ Docs: https://docs.openclaw.ai
 
 ### Fixes
 
+- Security/Webhooks: harden Feishu and Zalo webhook ingress with webhook-mode token preconditions, loopback-default Feishu bind host, JSON content-type enforcement, per-path rate limiting, replay dedupe for Zalo events, constant-time Zalo secret comparison, and anomaly status counters.
 - Security/Plugins: add explicit `plugins.runtime.allowLegacyExec` opt-in to re-enable deprecated `runtime.system.runCommandWithTimeout` for legacy modules while keeping runtime command execution disabled by default. (#20874) Thanks @mbelinky.
 - Gateway/WebChat: block `sessions.patch` and `sessions.delete` for WebChat clients so session-store mutations stay restricted to non-WebChat operator flows. Thanks @allsmog for reporting.
 - Security/Skills: for the next npm release, reject symlinks during skill packaging to prevent external file inclusion in distributed `.skill` archives. Thanks @aether-ai-agent for reporting.
diff --git a/docs/channels/feishu.md b/docs/channels/feishu.md
index 461facdbb2..e92f84460d 100644
--- a/docs/channels/feishu.md
+++ b/docs/channels/feishu.md
@@ -193,6 +193,8 @@ Edit `~/.openclaw/openclaw.json`:
 }
 ```
 
+If you use `connectionMode: "webhook"`, set `verificationToken`. The Feishu webhook server binds to `127.0.0.1` by default; set `webhookHost` only if you intentionally need a different bind address.
+
 ### Configure via environment variables
 
 ```bash
@@ -527,23 +529,28 @@ Full configuration: [Gateway configuration](/gateway/configuration)
 
 Key options:
 
-| Setting                                           | Description                     | Default   |
-| ------------------------------------------------- | ------------------------------- | --------- |
-| `channels.feishu.enabled`                         | Enable/disable channel          | `true`    |
-| `channels.feishu.domain`                          | API domain (`feishu` or `lark`) | `feishu`  |
-| `channels.feishu.accounts.<id>.appId`             | App ID                          | -         |
-| `channels.feishu.accounts.<id>.appSecret`         | App Secret                      | -         |
-| `channels.feishu.accounts.<id>.domain`            | Per-account API domain override | `feishu`  |
-| `channels.feishu.dmPolicy`                        | DM policy                       | `pairing` |
-| `channels.feishu.allowFrom`                       | DM allowlist (open_id list)     | -         |
-| `channels.feishu.groupPolicy`                     | Group policy                    | `open`    |
-| `channels.feishu.groupAllowFrom`                  | Group allowlist                 | -         |
-| `channels.feishu.groups.<chat_id>.requireMention` | Require @mention                | `true`    |
-| `channels.feishu.groups.<chat_id>.enabled`        | Enable group                    | `true`    |
-| `channels.feishu.textChunkLimit`                  | Message chunk size              | `2000`    |
-| `channels.feishu.mediaMaxMb`                      | Media size limit                | `30`      |
-| `channels.feishu.streaming`                       | Enable streaming card output    | `true`    |
-| `channels.feishu.blockStreaming`                  | Enable block streaming          | `true`    |
+| Setting                                           | Description                     | Default          |
+| ------------------------------------------------- | ------------------------------- | ---------------- |
+| `channels.feishu.enabled`                         | Enable/disable channel          | `true`           |
+| `channels.feishu.domain`                          | API domain (`feishu` or `lark`) | `feishu`         |
+| `channels.feishu.connectionMode`                  | Event transport mode            | `websocket`      |
+| `channels.feishu.verificationToken`               | Required for webhook mode       | -                |
+| `channels.feishu.webhookPath`                     | Webhook route path              | `/feishu/events` |
+| `channels.feishu.webhookHost`                     | Webhook bind host               | `127.0.0.1`      |
+| `channels.feishu.webhookPort`                     | Webhook bind port               | `3000`           |
+| `channels.feishu.accounts.<id>.appId`             | App ID                          | -                |
+| `channels.feishu.accounts.<id>.appSecret`         | App Secret                      | -                |
+| `channels.feishu.accounts.<id>.domain`            | Per-account API domain override | `feishu`         |
+| `channels.feishu.dmPolicy`                        | DM policy                       | `pairing`        |
+| `channels.feishu.allowFrom`                       | DM allowlist (open_id list)     | -                |
+| `channels.feishu.groupPolicy`                     | Group policy                    | `open`           |
+| `channels.feishu.groupAllowFrom`                  | Group allowlist                 | -                |
+| `channels.feishu.groups.<chat_id>.requireMention` | Require @mention                | `true`           |
+| `channels.feishu.groups.<chat_id>.enabled`        | Enable group                    | `true`           |
+| `channels.feishu.textChunkLimit`                  | Message chunk size              | `2000`           |
+| `channels.feishu.mediaMaxMb`                      | Media size limit                | `30`             |
+| `channels.feishu.streaming`                       | Enable streaming card output    | `true`           |
+| `channels.feishu.blockStreaming`                  | Enable block streaming          | `true`           |
 
 ---
 
diff --git a/docs/channels/zalo.md b/docs/channels/zalo.md
index c595c5e6dd..cda126f564 100644
--- a/docs/channels/zalo.md
+++ b/docs/channels/zalo.md
@@ -115,6 +115,9 @@ Multi-account support: use `channels.zalo.accounts` with per-account tokens and
   - Webhook URL must use HTTPS.
   - Zalo sends events with `X-Bot-Api-Secret-Token` header for verification.
   - Gateway HTTP handles webhook requests at `channels.zalo.webhookPath` (defaults to the webhook URL path).
+  - Requests must use `Content-Type: application/json` (or `+json` media types).
+  - Duplicate events (`event_name + message_id`) are ignored for a short replay window.
+  - Burst traffic is rate-limited per path/source and may return HTTP 429.
 
 **Note:** getUpdates (polling) and webhook are mutually exclusive per Zalo API docs.