Why is 'pull_request_target' considered higher risk than 'pull_request' when used with secrets?
Select an answer to reveal the explanation.
Short Explanation and Infographic
pull_request_target is the VIP pass — it runs with base repo secrets even when the code comes from a fork you don't control. That's the danger.
Full explanation below image
Full Explanation
'pull_request' runs in the context of the fork, with no access to secrets from the base repository. 'pull_request_target' runs in the context of the base repository, giving it access to secrets and write permissions — even when triggered by a PR from an untrusted fork. This means a malicious PR could potentially execute code with access to your secrets. Safe usage of 'pull_request_target' requires never checking out the PR code and running it with elevated permissions. The event does not auto-merge and can be restricted by branch.