We might think about whitelisting repositories.
I am seeing several check_suite webhooks from repositories that have forked *jekyll/jekyll. These repositories have not installed the app, but every time they create a PR (which seems to happen frequently and randomly), a new build is triggered.