Post

most of these github actions driven breaches are because of pull_request_target. here's some tips of what to look for when reviewing your own workflows. worth noting - it is safe, and necessary, when used correctly 🧵

llimllib

@billmill.org

it's "safe" in the same way that a mandolin slicer is "safe" - it's possible to use it safely, but requires care and constant attention. I don't think I'd call it generally, "safe"

12/5/26, 12:22 pm0 reposts8 likes

James

@43081j.com

12 May

that's fair. the risk of misconfiguring it is very high, especially in a not-so-secure way. so, in that way, it is unsafe to use

Wes

@notwes.bsky.social

12 May

I would say it is “unsafe by default”.