You can use a webhook secret to verify that a webhook delivery is from GitHub. About validating webhook deliveries Once your server is configured to receive payloads, it will listen for any delivery that's sent to the endpoint you configured. To ensure that your server only processes webhook deliveries that were sent by GitHub and to ensure that the delivery was not tampered with, you should valid
![Validating webhook deliveries - GitHub Docs](https://cdn-ak-scissors.b.st-hatena.com/image/square/c852e55126697503d2d6aa748d905fcfaf8eface/height=288;version=1;width=512/https%3A%2F%2Fgithub.githubassets.com%2Fimages%2Fmodules%2Fopen_graph%2Fgithub-logo.png)