GitHub Actions Gets Secure-by-Default CI/CD: Backport Shuts the Pwn Request Window

GitHub deployed a security enforcement that blocks untrusted code from fork pull requests in privileged CI/CD contexts by default across all supported `actions/checkout` versions. The change closes a five-year-old attack vector demonstrated in the AsyncAPI supply chain compromise, which exposed npm publishing tokens and backdoored four packages with 2.25 million weekly downloads.

This Wire brief sits within Fusion42's coverage of Developer Tools and Cybersecurity. Wire is Fusion42's founder-focused intelligence feed: each story is connected to the funds and startups it names — every one with a live profile on Raise or Scout — so founders can follow the capital and the momentum behind the headline rather than just the headline itself. Wire analysis is one of the live surfaces Arthur reasons over.