callback.php location for the code that checks for a $secret match

[dennisbabkin]

You may want to move the if statement that checks for a match of $secret to the very beginning of the callback.php script. Definitely before you hit the database to prevent possible abuse.