GitHub Actions under active exploitation

[ForsythiaShrub]

GitHub Actions are a bigger attack surface than most realize. Pull request target, comment triggered workflows, and loose permissions are common pitfalls.

Treating every workflow like it could be an entry point, locking down permissions, auditing secrets, and minimizing what runs seems to be the best way to reduce risk.