When using a Shared Secret, Jenkins will accept webhook requests, which are not signed at all.

• Github (Secret="123") --> Jenkins (Secret="123") 
• Github (Secret="wrong") --> Jenkins (Secret="123") 
• Github (Secret="") --> Jenkins (Secret="123")   This should not be "200 OK"

The last example shows what happens when you omit the Shared Secret on the Github Webhook Configuration page but not in Jenkins. I expected Jenkins to reject the request.