If your shared secret is vulnerable to brute forcing, it&#x27;s vulnerable to brute forcing. An easy fix for this: generate your shared secret by hashing or salthashing a low-entropy password.<p>As a general rule though, HMAC is used with randomly generated secrets. I don&#x27;t know why GitHub doesn&#x27;t just tell you the secret.<p>Amazon&#x27;s implementation is much more correct.