Comment on GitHub Actions is the weakest linkComments−60secs4mopull_request_target is criminally negligent -- github should simply disable it.The security risk for running unvalidated code on any random PR with access to account secrets has no legitimate use case which outweighs its unbounded risk.
Comments
pull_request_target is criminally negligent -- github should simply disable it.
The security risk for running unvalidated code on any random PR with access to account secrets has no legitimate use case which outweighs its unbounded risk.