Keeping your GitHub Actions and workflows secure: Preventing pwn requests (2021) (opens in new tab)

Covered by 7 sources including theregister, heise onlineDiscussed on Hacker News

Combining the pull_request_target workflow trigger with an explicit checkout of an untrusted Pull Request is a dangerous practice that may lead to repository compromise.

Read the original article

Sign in to keep reading the full article.

Sign Up Log In

Covered in 7 articles

theregister·

TanStack weighs invitation-only pull requests after supply chain attack

Discussed on Hacker News

github.blog·

Safer pull_request_target defaults for GitHub Actions checkout

Datadog Security Labs·

The case for GitHub Actions security after recent supply chain attacks

View all 7 ›