DANGEROUS BY DEFAULT: INSECURE GITHUB ACTIONS FOUND IN MITRE, SPLUNK, AND OTHER OPEN SOURCE REPOSITORIES

Summary from the TLDR InfoSec newsletter

The `pull_request_target` event is infamous because it opens up room for abuse by running in the context of the base repo with full secrets access and write permissions to the GITHUB_TOKEN. Sysdig found repositories belonging to MITRE, Splunk, and a popular open-source Spotify client that could be hijacked via `pull_request_target` abuse. Sysdig recommends using the `pull_request` event instead, along with workflow splitting and restricting GITHUB_TOKEN permissions to avoid these issues.