--- title: Safer pull_request_target defaults for GitHub Actions... description: GitHub is releasing actions/checkout v7, which blocks common 'pwn request' vulnerabilities by default. The pull_request_target event runs with elevated... canonical: https://daily.dev/posts/safer-pull-request-target-defaults-for-github-actions-checkout-cs5c6qtly twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Safer pull_request_target defaults for GitHub Actions checkout | daily.dev og:description: GitHub is releasing actions/checkout v7, which blocks common 'pwn request' vulnerabilities by default. The pull_request_target event runs with elevated... og:url: https://daily.dev/posts/safer-pull-request-target-defaults-for-github-actions-checkout-cs5c6qtly og:image: https://api.daily.dev/og/posts/cs5C6Qtly.png og:image:alt: Safer pull_request_target defaults for GitHub Actions checkout og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Safer pull_request_target defaults for GitHub Actions checkout **[GitHub Changelog](https://daily.dev/sources/github_updates)** · 3 min read · 0 upvotes · 0 comments ## Summary GitHub is releasing actions/checkout v7, which blocks common 'pwn request' vulnerabilities by default. The pull_request_target event runs with elevated privileges (base repo GITHUB_TOKEN, secrets, cache), and checking out fork PR code in these workflows has historically allowed attacker-controlled code to execute with full workflow privileges. The new version refuses to fetch fork PR code in pull_request_target and workflow_run workflows when insecure inputs like refs/pull/*/head or fork repository names are used. On July 16, 2026, this enforcement will be backported to all supported major versions, automatically affecting workflows pinned to floating major tags. Workflows that legitimately need fork checkout with elevated trust can opt out using the allow-unsafe-pr-checkout input flag. Same-repository PRs and the standard pull_request event are unaffected. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [GitHub Actions hardens checkout security to block ‘pwn request’ attacks](https://daily.dev/posts/github-actions-hardens-checkout-security-to-block-pwn-request-attacks-9pqi2ntb0) · InfoWorld · 0 upvotes · 0 comments - [Security Checklist for GitHub Actions](https://daily.dev/posts/security-checklist-for-github-actions-up1jad7nx) · Aikido Security · 5 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#github](https://daily.dev/tags/github), [#cicd](https://daily.dev/tags/cicd), [#github-actions](https://daily.dev/tags/github-actions) [View this post on daily.dev](https://daily.dev/posts/safer-pull-request-target-defaults-for-github-actions-checkout-cs5c6qtly) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Safer pull_request_target defaults for GitHub Actions checkout","url":"https://daily.dev/posts/safer-pull-request-target-defaults-for-github-actions-checkout-cs5c6qtly","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/safer-pull-request-target-defaults-for-github-actions-checkout-cs5c6qtly"},"datePublished":"2026-06-18T15:37:45.591Z","dateModified":"2026-06-18T17:32:43.700Z","description":"GitHub is releasing actions/checkout v7, which blocks common 'pwn request' vulnerabilities by default. The pull_request_target event runs with elevated...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/176b87abcf99e4df03b13954ac54c938?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/176b87abcf99e4df03b13954ac54c938?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"GitHub Changelog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"GitHub Changelog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/15004b7835da4d89b02b115871f0f6dc","url":"https://daily.dev/sources/github_updates"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/safer-pull-request-target-defaults-for-github-actions-checkout-cs5c6qtly","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,github,cicd,github-actions","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"GitHub Changelog","item":"https://daily.dev/sources/github_updates"},{"@type":"ListItem","position":3,"name":"Safer pull_request_target defaults for GitHub Actions checkout"}]} ```