Monkeytype CI workflow: code execution with elevated token via fork pull request
The format-fixing GitHub Actions workflow of the Monkeytype repository runs on pull_request_target with write permissions and executes code from a fork pull request. An external contributor whose pull request receives the format label can run arbitrary code, read the GITHUB_TOKEN and push repository content or modify pull requests and issues. The typing test application and user data are not affected.
monkeytypegame · Monkeytype
