cicd-security

This excerpt is a security-review report, not executable package code. It describes a high-severity CI risk in .github/workflows/pr-preview.yml: fork-controlled code reportedly runs under pull_request_target with VERCEL_TOKEN and write permissions, with checkout credentials potentially persisted in .git/config. The issue-title injection finding is reported as ruled out, and no malware behavior is evidenced in the excerpt itself; review the actual workflow to verify the reported exposure.