pull_request_target

GitHub actions/checkout v7 now blocks pwn request attacks by default. Learn how the pull_request_target exploit worked, what changes, and what supply chain gaps remain.