Dang, well good to know!

@user10216038, Yeah, I tried that too! With a bash script... From some searching I did, it sounds like if you can compile something into a binary executable file, then it'll work without the read permission. There was a utility to do that with bash & I think I saw it can be done with C code as well.

I kind of like the idea of executing under a different user, but I think that's beyond what's possible given that I'm on shared hosting. My public key is saved in the github webhook, so that would be exposed if somebody cracked my github. The public key is NOT stored on my server, but it can be generated from the private file without a password (via ssh-keygen -y -f ~/path/to/file), so the public key might as well just be on my server.

This recreates what github sends me: 'sha1='.hash_hmac('sha1',$requestBody,$publickKey);, then I use hash_equals to compare what I generate to what they sent me. It's very similar to what they suggest.

I saw security.stackexchange.com/questions/105207/… from 5 years ago, but it's old & I have not idea what LD_PRELOAD is. It looks like reverseengineering.stackexchange.com/questions/98/… might be similar, but answers are 7 years old.