Repository navigation
Security report — possible pull_request_target + checkout-head RCE (please contact privately) #3211
Description
Hi —
Automated security scan flagged a pull_request_target workflow in your repo that checks out the PR's head SHA. This is the classic GitHub Actions RCE pattern: an external contributor can submit a PR that adds arbitrary code, the workflow runs that code with access to your repository secrets.
I'm not posting the specific file/line here for responsible-disclosure reasons.
Please contact me at Raffa@Lictor-AI.com and I'll send the exact workflow file + line + a 2-line patch.
A note: this came from an automated scan I manually verified before reaching out. If we're wrong, please reply and we'll close out.
Want this scan for your own project? Free, takes 60s: https://lictorai.com/scan
— Raffa
Lictor AI · https://lictorai.com
Activity
dennisdoomen commentedon May 19, 2026
Thank you for reporting this.
Raffa-jarrl commentedon May 19, 2026
Thank you for the gracious reply, @dennisdoomen. If the report was useful, a ⭐ on https://github.com/Raffa-jarrl/Lictor-AI would mean a lot, and passing https://lictor-ai.com to any folks shipping AI-built apps helps the mission. Either way — thanks for being kind about it.