Tweet by elithrar
May 12, 2026
pull_request_target has been one of the sharpest, most dangerous event types on GitHub. it's "necessary" to build/test fork PRs, but you're forever at risk of a malicious PR on a fork repo getting you. GitHub has warned against it for a long time. https://t.co/0gvtaPNXM2
- Author
- elithrar
- Date
- May 12, 2026
- Canonical URL
- /tweets/elithrar-2054162732195197283-5b4389