From bcd2d111431ada1345bba7d5c3f5eef5c949cf90 Mon Sep 17 00:00:00 2001
From: Andrew Rabert <ar@nullsum.net>
Date: Thu, 19 Feb 2026 23:53:48 -0500
Subject: [PATCH] Mitigate pull_request_target privilege escalation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Hotfix — replaces pull_request_target with pull_request to stop
granting write permissions and secrets to fork PRs. Some workflows
will break; can be fixed properly later.
---
 .github/workflows/pull_request.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
index 6932936c6..b557f6553 100644
--- a/.github/workflows/pull_request.yml
+++ b/.github/workflows/pull_request.yml
@@ -5,7 +5,7 @@ concurrency:
   cancel-in-progress: true
 
 on:
-  pull_request_target:
+  pull_request:
     branches:
       - master
       - release*