---
title: GitHub will block pull_request_target in public repos by default from Dec 2, with a first two-hour brownout today, Nov 9, 16:00 to 18:00 UTC | ctxsec
url: https://ctxsec.com/items/github-pull-request-target-brownout-nov-9-enforced-dec-2
description: "GitHub Actions is adding a default rule that blocks pull_request_target events in public repositories unless an Actions event policy explicitly allows them, because that trigger runs with the base repository's secrets and is a common route for Pwn Request attacks. The rule is in evaluate mode now; during brownouts on Nov 9 and Nov 16 (16:00 to 18:00 UTC, 11 AM to 1 PM ET) blocked workflows fail with an error annotation, and enforcement becomes permanent on Dec 2. Private and internal repos and GitHub Enterprise Server are not affected."
status: "official (GitHub Changelog, Nov 2; GitHub Docs)"
published: 2026-11-09
---

> GitHub Actions is adding a default rule that blocks pull_request_target events in public repositories unless an Actions event policy explicitly allows them, because that trigger runs with the base repository's secrets and is a common route for Pwn Request attacks. The rule is in evaluate mode now; during brownouts on Nov 9 and Nov 16 (16:00 to 18:00 UTC, 11 AM to 1 PM ET) blocked workflows fail with an error annotation, and enforcement becomes permanent on Dec 2. Private and internal repos and GitHub Enterprise Server are not affected.

[← Industry News](/industry) · [markdown](/items/github-pull-request-target-brownout-nov-9-enforced-dec-2.md)

official (GitHub Changelog, Nov 2; GitHub Docs)

2026-11-09

### GitHub will block pull_request_target in public repos by default from Dec 2, with a first two-hour brownout today, Nov 9, 16:00 to 18:00 UTC

- Use policy Insights to see which workflow runs would be blocked.
- Either keep the default block, switch the workflow to `pull_request`, or allow `pull_request_target` for specific workflow files in an Actions event policy.
- Applies to public repos on GitHub Free, Team and Enterprise Cloud.

Sources: [GitHub Changelog: pull_request_target blocked by default December 2](https://github.blog/changelog/2026-11-02-pull_request_target-blocked-by-default-december-2/) · [GitHub Docs: Securely using pull_request_target](https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target)