May 12, 20269 min readThe Hidden Risk in Your CI Pipeline: Why `pull_request_target` Is a Security Liabilitypull_request_target gives CI workflows full secret access. One open PR is enough to steal credentials or poison your build cache. Here is how to fix it.
May 12, 20264 min readWhy I'm Glad I Upgraded to pnpm 11 Before the TanStack AttackI use pnpm for disk space and monorepo support. Turns out upgrading to v11 also made me immune to the May 2026 TanStack supply chain attack - here is what its defaults actually do and why they matter.
