A misconfigured trigger can hand your secrets to a stranger's fork.

Applying STRIDE to the pipeline itself surfaces a real, named pattern: a trigger that runs untrusted fork code with access to real repository secrets.

Spoofing

fake CI job/webhook

Tampering

artifact modified in transit

Info disclosure

secrets via malicious PR

Elevation

compromised 3rd-party action

The "pwn request" pattern

Attacker modifies workflow in their fork

Opens a PR against the real repo

Triggers pull_request_targetwrong trigger — runs with real secrets

Secrets exfiltratede.g. printed to a log

Only use pull_request_target when the workflow does NOT check out and execute the untrusted fork's own code — otherwise, use plain pull_request, which has no secret access.