A safer checkout can block one path.
What still fetches and executes the PR?
Map sanitized privileged-workflow paths after checkout v7's pwn-request defaults. Separate what the Action blocks from fixed pins, git/gh fetches, issue comments, unrelated repositories, explicit opt-outs and broader execution privileges—without pasting YAML, refs or logs.
Pwn-request checkout boundary map
| Path | Event / checkout | Source / fetch | Execution / privilege | Opt-out / alternative / test | Evidence / owner | Decision / result |
|---|
Coverage-gap, attack-path and negative-test queue
“Evidence recorded” proves only coherent abstract metadata. This page did not inspect a workflow, repository, ref, SHA, expression, script, token, secrets, permissions or logs; execute code; test checkout behavior; change a workflow; or guarantee security.
Zero-YAML boundary: all free analysis stays in this browser. Enter only fictional aliases, enumerated states and safe evidence references. Never paste a real organization/repository, Action reference, workflow/YAML, ref/SHA, expression, script/code, log, token, secret, actor or private data. This page does not scan workflows, establish reachability, calculate permissions, execute untrusted code, connect to GitHub, change a workflow or certify security. Authorized Actions security, platform and repository owners control every real review, test and release decision.
$20 Pwn-Request Checkout Boundary Evidence Pack
Export an editable matrix for up to 100 sanitized paths: checkout-v7 coverage, pins and alternative fetch gaps, source→execution→privilege attack paths, opt-outs, safer split-workflow alternatives, negative tests, sign-off and PMF ledger.
- up to 100 sanitized privileged-event paths
- checkout-v7 coverage and fixed-pin upgrade queue
- source → fetch → execution → privilege attack-path matrix
- git/gh, issue-comment, third-party and opt-out negative tests
- split-workflow alternative plus human sign-off
- 30-day qualified-visit, use, intent and paid ledger
Current GitHub checkout protection and broader pwn-request boundary
PMF pre-judgment 92/100 · $20 one-time evidence pack under checkout v7 and strong native security substitutes