Trailing newline from 'echo' command silently broke every webhook HMAC signature

A developer building a GitHub Marketplace integration found that every single inbound webhook failed HMAC-SHA256 signature verification, with no intermittent failures to suggest a logic bug. After ruling out raw-body parsing issues, wrong algorithms, and timing-safe comparison errors, the culprit turned out to be a trailing newline character appended by the 'echo' command when writing the shared secret to a .env file. Because GitHub stores the secret without a trailing newline, its computed signature never matched the server's, which was hashing with an invisible extra byte. The fix was replacing 'echo' with 'printf "%s"', which outputs exactly what is given without appending anything. The author recommends printing a server-side length and repr-dump of any secret as the first debugging step in signature mismatches, and advises against transiting secrets through shell sessions without validation.