@dang: The original URL (from Step Security, the company that discovered this flaw) is a better source for this:

https://www.stepsecurity.io/blog/harden-runner-detection-tj-...