6.1. Security Best Practices
💡 First Principle: Every workflow run is an execution of code with credentials, and the security question is always the same three-part audit — whose code is running, what authority does it hold, and what untrusted data can influence it? Every control below answers one of those three.
Why care: the consequences are concrete and recent. A moved tag on a popular action dumped secrets from thousands of repositories in 2025. Script injection through a pull request title has been used to exfiltrate tokens. A self-hosted runner on a public repository is a foothold inside a corporate network. None of these require exotic skill — they exploit defaults nobody tightened.
⚠️ Common Misconception: "Our repository is private, so workflow security is a lower priority." Private repositories remove the anonymous-attacker path but not the others: a compromised third-party action still runs with your token, a self-hosted runner still sits in your network, and an over-permissioned GITHUB_TOKEN still lets one workflow rewrite branches it shouldn't. The controls below are about limiting blast radius, which matters regardless of visibility.
