You generate the GitHub webhook secret yourself. GitHub does not issue it.

For your Windows environment, the easiest secure method is PowerShell. Open PowerShell and run:

-join ((1..64) | ForEach-Object { '{0:x}' -f (Get-Random -Maximum 16) })

That will generate a 64-character random secret. A stronger cryptographic method is:

$bytes = New-Object byte[] 32
[System.Security.Cryptography.RandomNumberGenerator]::Fill($bytes)
[Convert]::ToHexString($bytes).ToLower()

You will get something resembling:

a7f92c8d4e1b6f03c9d85a1e74b2f6c89103d7e5a9c42f1b8e60d3c57a41f296

Use that same exact secret in two places:

UHD_EOD_GITHUB_WEBHOOK_SECRET=a7f92c8d4e1b6f03c9d85a1e74b2f6c89103d7e5a9c42f1b8e60d3c57a41f296

Then, when you create the webhook inside GitHub, paste the same value into GitHub's Secret field.

So the relationship is:

GitHub Webhook
      │
      │ Secret: SAME RANDOM VALUE
      ▼
UHD Production .env

UHD_EOD_GITHUB_WEBHOOK_SECRET=SAME RANDOM VALUE

GitHub will use that secret to calculate the X-Hub-Signature-256 signature on webhook requests, and the UHD code your developer built will verify that signature before accepting the webhook.

Do not send this secret to me, put it in GitHub source code, README files, or EOD notes. Store it with your other production credentials.

Also, this secret is completely different from the GitHub PAT:

UHD_EOD_GITHUB_TOKEN=<YOUR GITHUB PAT>
UHD_EOD_GITHUB_WEBHOOK_SECRET=<YOUR RANDOMLY GENERATED SECRET>

The PAT lets UHD read GitHub.
The webhook secret verifies that incoming messages really came from GitHub.