GitHub to block pull_request_target by default in affected public repos on Nov 2, 2026

GitHub has announced that on November 2, 2026, it will enforce a default policy blocking the pull_request_target event in affected public repositories. The default rule does not apply to private or internal repositories and does not replace an existing Actions event policy. Until enforcement, the rule runs in evaluate mode, and policy insights can show which workflow runs would be blocked. The article warns against making failing checks pass by broadly granting privileges or allow-listing the event without reviewing what code actually runs. It recommends auditing workflows that use the event, checking whether fork-controlled code executes with privileged secrets, and reviewing GitHub's official documentation before changing policies.