Poisoned Pipeline / Mitigations / M1481
M1481
Avoid using self-hosted runners for public repositories
We recommend that you only use self-hosted runners with private repositories.
This is because forks of your public repository can potentially run dangerous code on your self-hosted runner machine by creating a pull request that executes the code in a workflow.
This is not an issue with GitHub-hosted runners because each GitHub-hosted runner is always a clean isolated virtual machine, and it is destroyed at the end of the job execution.
Applies to
- T0148 Scheduled tasks on self hosted runner