pr-box: only /webhook/* is exposed publicly