In the readme it clearly states that there are three arguments sent to the secret option when it is defined as a function:
this option can also be a function that takes the following parameters: (request, data, callback).
But the actual code only ever sends the request object and the callback:
if (typeof this.secret === 'function') {
return this.secret(req, next);
}
https://github.com/nlf/node-github-hook/blob/master/index.js#L278
The data is not available in that scope, as it's not passed to the getSecret method:
self.getSecret(req, function (err, secret) {
https://github.com/nlf/node-github-hook/blob/master/index.js#L88
But it is clearly available at that time, as that method is called after req.on('end', ...).