pull_request_target in the wild: 60 public workflows, 6 exploitable, and the fixes that actually work

·1 views

pull_request_target is the GitHub Actions trigger behind a steady stream of and runs it. We ship a rule for exactly that combination. Before trusting it, we measured it Three ingredients, all of them needed: the pull_request_target trigger; a checkout of the pull request's own code (ref: ${{ github.event.pull_request.head.sha }} or .head.ref); a step that executes that code: install scripts, a build, the test suite. With all three, anyone who can open a pull request runs their code with your We sampled 30 public workflows that use pull_request_target. The rule fired on On review, 8 of the 15 w

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Monitoring AI coding agent costs and activity on your own machine

I run Claude Code, Cursor, Codex and a handful of sub-agents on my own machines every day. For a long time, I knew what they cost but had little visibility into their work. If an agent felt slow or got stuck, I had to dig through separate logs to understand why. That became harder as I started using several agents on the same project. Each kept its own session history, and there was no single place to review the activity.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Autoscaling doesn't save you at 30,000 requests per second — your dependencies do

There's a comfortable story about peak traffic: load goes up, the autoscaler notices, pods multiply, everyone keeps their evening. I've watched that story hold, and I've watched it fail in a specific and instructive way — the autoscaler worked perfectly and the platform degraded anyway. Running transaction paths at sustained peaks in the tens of thousands of requests per second teaches you that horizontal scaling is the easy half of the problem. The hard half is that everything your new pods talk to did not scale, and now there are more of them asking. Scale-up triggers.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

What If an AI Could Answer a Legal Question Based on the Law That Existed At That Time?

What If an AI Could Answer a Legal Question Based on the Law That Existed At That Time? I've been working on a research project called Indian Constitution Temporal QA, and it started with a question that sounds simple: Can an AI answer a question about the Indian Constitution while taking the date of the question into account? Most question-answering systems treat a document as if it is static. Legal documents aren't. The Indian Constitution has been amended repeatedly.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

A cache key ate 99.9% of my records and the pipeline looked green

The worst pipeline bug I've shipped didn't throw. No stack trace, no failed job, no alert. Every run went green, finished inside its window, and wrote roughly one record out of every thousand it was handed. The job's own metrics said it was healthy, because the job's own metrics counted runs, not rows. It took a business user asking why a campaign list looked short to surface it.

0 comments Read more at DEV Community