Security report — possible pull_request_target + checkout-head RCE (please contact privately)

Hi —

Automated security scan flagged a `pull_request_target` workflow in your repo that checks out the PR's head SHA. This is the classic GitHub Actions RCE pattern: an external contributor can submit a PR that adds arbitrary code, the workflow runs that code with access to your repository secrets.

I'm not posting the specific file/line here for responsible-disclosure reasons.

Please contact me at **Raffa@Lictor-AI.com** and I'll send the exact workflow file + line + a 2-line patch.

A note: this came from an automated scan I manually verified before reaching out. If we're wrong, please reply and we'll close out.

Want this scan for your own project? Free, takes 60s: **https://lictorai.com/scan**

— Raffa
Lictor AI · https://lictorai.com

Jira issue: PEBBLE-1444

The report withholds the workflow file and line, so start by reviewing the repository's pull_request_target workflows and contacting the reporter for the exact location and reproduction details. Verify whether a PR head SHA is checked out and whether untrusted code can access secrets; done means the exposure is confirmed and the workflow is safely corrected, with validation of the relevant workflow checks.

Written by the indexing model from the issue text.