diff --git a/packages/trigger-sdk/src/security.ts b/packages/trigger-sdk/src/security.ts
index 456b275ed..663437d6b 100644
--- a/packages/trigger-sdk/src/security.ts
+++ b/packages/trigger-sdk/src/security.ts
@@ -19,6 +19,13 @@ export async function verifyRequestSignature({
       supported. */
   algorithm: "sha256";
 }): Promise<VerifyResult> {
+  if (!secret) {
+    return {
+      success: false,
+      reason: "Missing secret – you've probably not set an environment variable.",
+    };
+  }
+
   const headerValue = request.headers.get(headerName);
   if (!headerValue) {
     return { success: false, reason: "Missing header" };