Suggested practice #3 is equally as important: > Provide a secret token to ensure payloads are definitely coming from GitHub. By enforcing a secret token, you'

Suggested practice #3 is equally as important: > Provide a secret token to ensure payloads are definitely coming from GitHub. By enforcing a secret token, you're ensuring that any data received by your server is absolutely coming from GitHub