Tag See all →

#ci-security

2 stories

Banner: GitHub Actions pull_request_target workflow exposing secrets to code from forks

DevOps & CI/CD Bug Report

GitHub Actions pull_request_target ran fork code with our secrets: closing the gap

Ryan Pham · May 7, 2025 · 6 min read

An internal audit found a workflow that used pull_request_target to post preview links and also checked out the pull request's code and ran npm install. Any fork PR could have run code with our deploy token. We split it into an unprivileged build and a privileged comment step.

Banner: compromised GitHub Action with repointed version tags leaking CI secrets

DevOps & CI/CD Bug Report

A compromised GitHub Action rewrote its tags: why we now pin every action to a SHA

Ryan Pham · Mar 26, 2025 · 6 min read

In March 2025 the popular tj-actions/changed-files action was compromised and its version tags were repointed to code that printed CI secrets into workflow logs. Three of our repositories used it by tag. This is how we checked exposure, rotated secrets and moved to SHA pinning.