GitHub Actions hardens checkout security to block ‘pwn request’ attacks

Stung by a surge in cyberattacks that have run amok in developer environments, GitHub has strengthened the security of actions/checkout to block ‘pwn request’ attacks that exploit insecure use of the pull_request_target workflow trigger to run an attacker’s code with the workflow’s full privileges. …

View Post on Scour ↗

More from CSO Online on Scour.

Covers Safer pull_request_target defaults for GitHub Actions checkout