Public fork PRs normally get a read-only token and no repository secrets. Privileged triggers, runner access and untrusted shell input can break that boundary.
an account raises the per-topic limit · no card
← CI/CD, Release Engineering & GitOps / 20
hard★ EssentialNewCloudflareGitLabStripe
A stranger opens a pull request from their fork. What can that PR execute in your pipeline, and where does pull_request_target go wrong?
Public fork PRs normally get a read-only token and no repository secrets. Privileged triggers, runner access and untrusted shell input can break that boundary.
Updated Sep 2026 · Grounded in researched DevOps, SRE and platform engineering interview loops, written to a senior-engineer editorial bar, and never padded to hit a word count.
UP NEXT ON YOUR JOURNEY
Next in this trackRoughly a third of our CI failures are flakes. How do you run a quarantine programme that does not become a graveyard?Next in this trackThe column shipped with expand-and-contract and a billion rows still hold nulls. How do you run the backfill?Next in this trackTwelve clusters across three regions take every release. How do you stage the rollout so one bad build cannot hit everywhere?
DISCUSSION · 0
Nothing here yet. Say how you would answer it.