Security Advisory: Self-Hosted Runner Risk (Skor: 35/100)

## Security Advisory: Self-Hosted Runner Risk Tespit Edildi

Merhaba,

Bu repo'da **self-hosted GitHub Actions runner** kullanildigi ve **riskli trigger'larin** bulundugu tespit edilmistir.

### Tespit Edilen Sorunlar
- **Risk Skoru:** 35/100
- **Trigger'lar:** 22aydir guncel degil; self-hosted etiketi var
- Self-hosted runner etiketi bulunuyor
- 22 aydir guncellenmemis

### Oneriler
1. **Self-hosted runner** kullaniyorsaniz, runner'in guvenlik yamalarinin guncel oldugundan emin olun.
2. **Riskli trigger'lar** (`pull_request_target`, `issue_comment`, `workflow_run`, `repository_dispatch`) kullaniyorsaniz, ek guvenlik onlemleri alin:
- `pull_request_target` icin: base branch'i checkout ederken PR koduyla calismayin
- `issue_comment` icin: sadece yetkili kullanicilarin trigger'layabildiginden emin olun
- `workflow_run` icin: calisma ortamini kistlayin
3. Runner erisimini **sadece guvenilir workflow'larla** sinirlandirin.
4. Runner'in ag erisimini kistlayin.
5. **Token'larinizi** sifreli sekilde (GitHub Secrets) saklayin.

Detayli dokuman: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions

---

*Bu mesaj, guvenlik amaciyla otomatik olarak gonderilmistir. Herkesin bilgisayari guvende olsun.*

Start by reviewing the repository's GitHub Actions workflow files for the self-hosted runner label and the listed triggers: pull_request_target, issue_comment, workflow_run, and repository_dispatch. Compare their permissions, checkout behavior, runner access, network exposure, and token handling with the linked GitHub security-hardening guidance; done requires an agreed remediation scope and verification that the identified risks are addressed.

Written by the indexing model from the issue text.