This may not be a huge issue depending on mitigating controls but are they sayin...

daemonologist · 2025-10-22T23:31:52 1761175912

I think only collaborators can add labels on github, so not quite. Does seem a bit hazardous though (you could submit a legit PR, get the label, and then commit whatever you want?).

ajross · 2025-10-23T00:32:52 1761179572

Exposure also extends not just to the owner of the PR but anyone with write access to the branch from which it was submitted. GitHub pushes are ssh-authenticated and often automated in many workflows.

rixed · 2025-10-23T05:57:17 1761199037

So basically like https://docs.google.com/ ?

jeroenhd · 2025-10-23T06:14:36 1761200076

Yes, except on Google Docs you can't make the document steal credentials or download malware by simply clicking on the link.

It's more like sites.google.com.

bo0tzz · 2025-10-23T10:18:06 1761214686

No, it doesn't work at all for PRs from forks.

tgsovlerkhgsel · 2025-10-23T07:30:16 1761204616

That was my first thought - have the preview URLs possibly actually been abused through GitHub?

warkdarrior · 2025-10-22T23:25:23 1761175523

Excellent idea for cost-free phishing.