[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Tips & Guides · markdown

operational guidance (GitHub Changelog and Docs)

Tip: before Dec 2, allow pull_request_target only for the specific workflows that need it, and never check out fork code in them

  • Run today's brownout (Nov 9, 11 AM to 1 PM ET) as a test: anything that fails is a workflow you need to fix or allow.
  • Move label-and-comment bots to pull_request plus a separate privileged workflow_run step where possible.
  • In any allowed workflow, do not actions/checkout the PR head ref with secrets present.

Sources: GitHub Docs: Securely using pull_request_target · GitHub Changelog (Nov 2)