Adding warning and pointer to the Secrets Load function.

docs/userguide/operation/webhooks.md

@@ -122,4 +122,7 @@ kumo.on('make.webhook', function(domain, tenant, campaign)
 end)
 ```
 
+!!!warning
+    Storing credentials as hardcoded values in a policy script such as this is not recommended, instead use the built in Secrets Load function. See [https://docs.kumomta.com/reference/kumo.secrets/load/](https://docs.kumomta.com/reference/kumo.secrets/load/).
+
 This same methodology could also be used to deliver queued SMTP messages to a third-party API, see the [Routing Messages Via HTTP Request](../policy/http.md) page of the Policy chapter for more information.

docs/userguide/policy/http.md

@@ -2,7 +2,10 @@
 
 Some sending environments use a mixture of different services to send messages, and while it's possible to relay messages through many services using SMTP, some services are only/better served via an HTTP API.
 
-The following example shows how to send a queued message via custom lua, in this case assembling and API call and sending it to a third-part SMTP API relay provider.
+The following example shows how to send a queued message via custom lua, in this case assembling an API call and sending it to a third-party SMTP API relay provider.
+
+!!!warning
+    Storing credentials as hardcoded values in a policy script such as this is not recommended, instead use the built in Secrets Load function. See [https://docs.kumomta.com/reference/kumo.secrets/load/](https://docs.kumomta.com/reference/kumo.secrets/load/).
 
 ```lua
 kumo.on('make.mailgun', function(domain, tenant, campaign)
@@ -53,4 +56,4 @@ kumo.on('get_queue_config', function(domain, tenant, campaign)
 
   return kumo.make_queue_config {}
 end)
-```
+```