security

The Hidden Risk in Your CI Pipeline: Why `pull_request_target` Is a Security Liability

pull_request_target gives CI workflows full secret access. One open PR is enough to steal credentials or poison your build cache. Here is how to fix it.