GA-C006: Unrestricted pull_request_target
Warning Security
Why This Matters
`pull_request_target` runs in the context of the base repository with write permissions and access to secrets, even for PRs from forks. Without branch or path restrictions, any fork can trigger this workflow. The Shai Hulud v2 worm (November 2025) exploited this to create self-replicating workflows across repositories. Always add `branches:` or `paths:` filters.
How to Fix
Add branch or path restrictions to pull_request_target
Before (incorrect)
on:
pull_request_target:After (correct)
on:
pull_request_target:
branches: [main]Rule Details
- Rule Code
- GA-C006
- Severity
- Warning
- Category
- Security