···40 subscribe_secret: "token-for-docketeer-subscribers"
41```
4243+Values support environment variable interpolation via `$VAR` or `${VAR}`
44+syntax, so secrets can come from the environment rather than being hardcoded:
45+46+```yaml
47+paths:
48+ github.com/chrisguidry/docketeer:
49+ verify: hmac-sha256
50+ secret: "${WEBHOOK_SECRET}"
51+ signature_header: X-Hub-Signature-256
52+ subscribe_secret: "${SUBSCRIBE_TOKEN}"
53+```
54+55- Unconfigured paths accept POSTs without verification
56- Configured paths verify webhook signatures and reject invalid ones
57- Subscribe secrets require `Authorization: Bearer <token>` for SSE connections