May 12, 20269 min readThe Hidden Risk in Your CI Pipeline: Why `pull_request_target` Is a Security Liabilitypull_request_target gives CI workflows full secret access. One open PR is enough to steal credentials or poison your build cache. Here is how to fix it.