The pull_request_target event however allows for read/write access to the base repo and access to all of its secrets. It's not the event type you'd want to use whenever dealing with code that's incoming in a PR.

See the big warning at https://docs.github.com/en/actions/reference/events-that-tri....