Security report — possible pull_request_target + checkout-head RCE (please contact privately)

[Raffa-jarrl]

Hi —

Automated security scan flagged a pull_request_target workflow in your repo that checks out the PR's head SHA. This is the classic GitHub Actions RCE pattern: an external contributor can submit a PR that adds arbitrary code, the workflow runs that code with access to your repository secrets.

I'm not posting the specific file/line here for responsible-disclosure reasons.

Please contact me at Raffa@Lictor-AI.com and I'll send the exact workflow file + line + a 2-line patch.

A note: this came from an automated scan I manually verified before reaching out. If we're wrong, please reply and we'll close out.

Want this scan for your own project? Free, takes 60s: https://lictorai.com/scan

— Raffa
Lictor AI · https://lictorai.com

[RabbiIslamRony]

Confirmed—the reported workflow pattern is still present in .github/workflows/phpcs.yml. The workflow uses pull_request_target, checks out github.event.pull_request.head.sha, and then executes Composer and PHPCS from that checkout. This matches GitHub’s documented unsafe untrusted-code execution pattern. This issue should be prioritized and remain open until the workflow uses an unprivileged pull_request event or otherwise prevents PR-head code from executing in a privileged context.

[RabbiIslamRony]

The privileged workflow path has been removed in #2945. The PHPCS job now runs on the unprivileged pull request event with read-only contents permission, checks out the merge commit without persisted credentials, and limits analysis to PHP files changed by the pull request.

PR: #2945