TOPICS / 1 STORY

GitHub Actions Security

Every Pandromeda story on GitHub Actions Security: news, explainers, comparisons and guides, newest first.

GitHub graphic showing the Octocat silhouette inside a red radar circle with the text 'pull_request_target blocked by default December 2' and a RETIRED badge

pull_request_target Workflows Blocked by Default Dec. 2

Starting December 2, 2026, GitHub Actions blocks pull_request_target in public repos by default to stop fork-PR secret theft. Here's what changes and how to opt back in.

Felix MoreauNov 8