GitHub Actions Security: 7 Misconfigurations to Avoid

GitHub Actions is the most-targeted CI/CD platform in the world right now. Not because it's insecure by design because billions of automated workflows run on it daily, most with misconfigured permissions, mutable dependencies, and zero security review.

In 2026 alone: the Megalodon campaign poisoned thousands of repos in six hours. The TanStack cache poisoning attack published malicious packages with valid, signed provenance. The tj-actions/changed-files compromise exfiltrated secrets from thousands of repos in a single day.

All of them used GitHub Actions misconfigurations as the entry point.

---

The 7 misconfigurations covered:

1. Overly Permissive GITHUB_TOKEN — write-all is still the default for repos created before Feb 2023
2. pull_request_target with untrusted code — the pattern behind the highest-impact GHA CVEs ever disclosed
3. Unpinned third-party actions — @v4 is mutable; one compromised repo and every workflow picks it up
4. Expression injection (script injection) — ${{ github.event.pull_request.title }} in a run: block is a shell injection vector
5. Secrets in logs and artifacts — GitHub's masking only catches exact-match patterns; encoded values bypass it
6. Shared caches across trust boundaries — how the TanStack attack actually worked
7. Self-hosted runners without isolation — ephemeral by default on GitHub-hosted; not on yours

Plus a 5-minute hardening checklist and a one-command audit using zizmor.

---

Full breakdown with code examples, fixes, and a copy-paste checklist:

👉 GitHub Actions Security: 7 Misconfigurations to Avoid