The Pwn Request Reckoning: What Still Works Against GitHub Actions
// AI summary
GitHub Actions changes in 2026 make pull_request_target attacks harder, but residual attack surfaces still exist that require auditing.
// from the source
GitHub's 2026 Actions changes make pull_request_target attacks harder, but not impossible. Here's the residual attack surface and how to audit for it.