GitHub has released version 7 of its actions/checkout tool to block a common “pwn request” attack that abuses the pull_request_target workflow. Starting June 18, 2026, actions/checkout will refuse to fetch code from forked pull requests in pull_request_target and certain workflow_run events unless you explicitly set allow-unsafe-pr-checkout to true. If your workflow still needs to pull forked PR code, you’ll have to opt in; otherwise, refs like refs/pull/123/head or a matching commit SHA simply won’t load. The pull_request_target trigger runs in the context of the base repo’s default branch, carrying full read/write GITHUB_TOKEN access and any secrets you’ve granted. That makes it dangerous when combined with actions/checkout: a malicious PR could sneak in a script, steal your token, then push code or exfiltrate secrets. GitHub calls out cache poisoning, unauthorized write permissions and secret exposure as the main risks. Several recent supply-chain attacks have exploited this gap. The s1ngularity campaign hijacked multiple Nx packages. PostHog, TanStack and the kubernetes-el Emacs module also fell victim. Microsoft’s GitHub team emphasizes that this update only stops forked PR checkouts via actions/checkout. Other ways to load untrusted code—using git, GitHub CLI or different triggers—remain hazards you must guard against. To stay safe, only use pull_request_target when you really need its permissions. Switch to pull_request for code that doesn’t require secrets or write access. Lock down your workflow’s permissions, validate any user-supplied inputs and review every step that can execute external code.