Re:GitHub Actions is the weakest link
by 60secs on Tuesday April 28, 2026 @03:54PM
(#47939733)
pull_request_target is criminally negligent -- github should simply disable it.
The security risk for running unvalidated code on any random PR with access to account secrets has no legitimate use case which outweighs its unbounded risk.
The security risk for running unvalidated code on any random PR with access to account secrets has no legitimate use case which outweighs its unbounded risk.