Audit GitHub Actions for injection and privilege
pull_request_target with checkout of untrusted code, and expressions built from PR text, hand attackers your CI secrets.
Tag: ci-cd
Grep git history and CI for leaked secrets
A rotated secret still lives in history; scan commits, not just the current tree.