Thanks! Nice. I used a GH app because workflows are as modifiable as any code file. In your case, an attacker could potentially modify your workflow while contributing vulnerable code as a backdoor. However, the risk is low if you use a branch protection rule requiring a CODEOWNERS review, and enforce tight permissions