You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Several workflows use pull_request_target as a trigger. This trigger runs in the context of the base branch and has access to secrets, which requires careful handling. These workflows should be reviewed to ensure they follow best practices.
Activity
thisisnic commentedon Apr 14, 2026
I think this one is a false positive as they all have
persist-credentialsset tofalseand check out themainbranch only.raulcd commentedon Apr 14, 2026
I agree. Thanks @thisisnic for taking a look into those!