From 6cdf92f61b64670b342752fec8f06f427bbb43bb Mon Sep 17 00:00:00 2001
From: Andrew Rabert <6550543+andrewrabert@users.noreply.github.com>
Date: Thu, 19 Feb 2026 23:58:30 -0500
Subject: [PATCH] Mitigate pull_request_target privilege escalation (#2735)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Hotfix — replaces pull_request_target with pull_request to stop
granting write permissions and secrets to fork PRs. Some workflows
will break; can be fixed properly later.
---
 .github/workflows/pull_request.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
index 11ff4fae..3528f8d2 100644
--- a/.github/workflows/pull_request.yml
+++ b/.github/workflows/pull_request.yml
@@ -5,7 +5,7 @@ concurrency:
   cancel-in-progress: true
 
 on:
-  pull_request_target:
+  pull_request:
   merge_group:
 
 permissions: