If I were building something to handle webhooks I'd probably have a really minimal API which just takes the message as it comes in and then queues it for later

If I were building something to handle webhooks I'd probably have a really minimal API which just takes the message as it comes in and then queues it for later processing - that way you can either decide to let the queue back up, or add some more workers. Having said that, I'm pretty sure GitHub publish a list of their public IPs, so you could also limit what is allowed to call your API.