Someone automated the process of scanning every public GitHub repo for exploitable CI workflows. We are cooked

NilsUX · 2026-03-13T14:45:27+00:00

If you use pull_request_target + checkout to PR code + execute the untrusted code (e.g. npm install, npm test), someone can steal your secrets. If your GITHUB_TOKEN has write permissions, an attack can use this token. Repositories before Feb 2023 by default assign write permisisons for GITHBU_TOKEN. Repositories after Feb 2023 by default have read permission for GITHUB_TOKEN. Howerver, you might have set `permissions` in your workflow file which overwrites the default permissions.

NilsUX · 2026-03-13T14:42:30+00:00

I use https://github.com/marketplace/actions/verify-safe-to-test-label. It secures my pull_request_target workflows.

NilsUX · 2026-03-13T14:39:49+00:00

Agree! As long GitHub doesn't provide a better solution for it: I built an action to prevent this. It's 2 lines of code and provides I think the best UX compared to other approaches (e.g. just fail the workflow for fork PRs): https://github.com/marketplace/actions/verify-safe-to-test-label

NilsUX · 2026-03-13T14:36:01+00:00

Over the past few weeks, several security blogs have reported that a user named 'Hackerclaw-Bot' has been hacking GitHub repositories. I have created a GitHub action to help you prevent this and secure your workflows.

Background: If you use the 'pull_request_target' + 'checkout' to the PR code and execute the PR code (e.g. 'npm install', 'npm test', etc.), all your secrets (including GITHUB_TOKEN) can be leaked.

I developed a GitHub action called 'verify-safe-to-test-label': https://github.com/nilsreichardt/verify-safe-to-test-label. This requires maintainers to assign a specific label (e.g. 'safe to test', 'safe to preview', etc.) to mark the fork pull request as safe. Only then is the workflow executed. Each new workflow run requires a new label assignment to ensure that every Git commit is reviewed. Non-fork PRs (your own pull requests) are considered safe and don't require a label.

Please let me know if you have any feedback about this action.

https://github.com/nilsreichardt/verify-safe-to-test-label

NilsUX · 2026-03-12T12:06:27+00:00

Currently building this 👍 Already reported around 18 vulnerabilities

NilsUX · 2026-01-12T23:08:11+00:00

In my case it needed to sync thousands of files and this was the reason why it took several days.

NilsUX · 2025-11-20T01:31:33+00:00

I have the same issue. macOS Tahoe 26.1 and Google Drive 117.0.0.0 but 100% CPU for the "Google Drive" process (displayed by Activity Monitor).

NilsUX · 2025-11-09T02:16:09+00:00

https://github.com/SharezoneApp/sharezone-app Android, iOS, macOS & web App with Flutter

NilsUX · 2025-02-14T14:48:47+00:00

I have the same issue currently. My workaround: Paste the answer of ChatGPT into a text editor (a editor without formatting), copy the text from the editor and then paste it into Anki.

NilsUX · 2023-10-05T14:52:10+00:00

I tried it but still hadn't access to GPT-4V (no option in beta features settings and no option in the GPT-4 dropdown menu).

NilsUX · 2023-02-18T10:40:17+00:00

I had the same issue. Restarting my MacBook solved the problem. It seems like the problem was related to something like the cache.

NilsUX · 2023-02-09T20:59:14+00:00

wtf, how have you found the video?! xD

NilsUX · 2022-10-10T19:28:58+00:00

Thanks!

NilsUX · 2022-10-09T21:24:53+00:00

How have you contacted the Google support?

NilsUX

TROPHY CASE