github_webhook_example.php

<?php

require __DIR__ . '/../vendor/autoload.php';

error_reporting(E_ALL);

ini_set('error_reporting', E_ALL);

$payload = file_get_contents('php://input');

$hash = explode(
    '=',
    array_key_exists('X-Hub-Signature', getallheaders()) ? getallheaders()['X-Hub-Signature'] : "="
)[1];

if ($hash !== hash_hmac('sha1', $payload, 'secret')) {
    http_response_code(403);
    die(403);
}

This is crap code for a test, but it's the good way to secure a webhook.