A pull_request_target trigger plus ref: ${{ github.event.pull_request.head.sha }} in a checkout step. That combination lets any external contributor run arbitrary code with your repository's secrets and write token. This is the "pwn request" pattern, and it's in production workflows across some of the most popular open-source projects on GitHub.

I'll use a real finding (a CRITICAL-severity pwn request I discovered and privately disclosed in an Apache project) to explain how the attack works: what pull_request_target does differently from pull_request, why adding permissions: read-all doesn't protect you, and why the attacker needs nothing beyond opening a pull request.

Then I'll show the three mitigations that work: splitting into unprivileged build and privileged post-processing steps, using persist-credentials: false, and gating on the head repo matching the base.