Post #2978556
2026-05-12 17:19 UTC
@yossarian@infosec.exchange I wonder if anything would break if GH would just isolate pull_request_target as if it was a special branch, so it gets its own cache scope that inherits from main.
Replies (1)
-
@yossarian@infosec.exchange 2026-05-12 18:48
@prioinv@hachyderm.io in principle nothing would break, but I think it would still be pretty exploitable in practice due to people granting elevated permissions to those jobs