Misleading sentence in blog article

[alexsapps]

This statement is true given the context of the article, but read in isolation is quite misleading and can lead to a dangerous misunderstanding:

"Due to the dangers inherent to automatic processing of PRs, GitHub’s standard pull_request workflow trigger by default prevents write permissions and secrets access to the target repository."

• https://github.com/proxy/securitylab.github.com/resources/github-actions-preventing-pwn-requests/

It's only true when PR is from a forked repo, and that context is 3 paragraphs above this sentence in the article. The first time I read this sentence, I thought all pull requests can't access secrets, and that I can stop worrying about malicious users with write access to my repo and just use branch protection rules. But out of curiosity I kept reading anyway, and only then realized I was wrong.

Even though it would technically be redundant, maybe it's possible to clarify "...processing of PRs from forks..." or something.

[hvitved]

@JarLob: What do you think?

[JarLob]

Thanks for the feedback @alexsapps! The process of modifying GitHub blog post is not so straightforward, but we'll work on improving it.

[JarLob]

Ah, this one is actually at securitylab.github.com. Should be updated in few minutes.

[alexsapps]

looks good, thank you! 🙂