Will It Vibe?pull_request_target trigger
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 8 points from that category, once per scan, no matter how many places it turns up.
What it detects
The workflow triggers on pull_request_target, which runs with the base repository read/write token and secrets available even for pull requests from forks. It is safe only if it never checks out or executes the untrusted PR code.
Why it matters
pull_request_target runs in the context of the base repository, so it has the repository read/write token and access to secrets even when the pull request comes from a fork. That is intentional for labeling and commenting, but it becomes dangerous the moment the workflow checks out or runs the untrusted PR code.
How to fix it
Confirm this workflow never checks out or executes PR code. If it only needs to comment or label, keep it minimal and set least-privilege permissions. If it does need the PR code, move that work to a pull_request-triggered workflow (which has no secrets for forks), or split into a build job on pull_request plus a privileged job on workflow_run that validates before acting.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo