github

The workflow contains a serious supply-chain security risk. The combination of pull_request_target, checking out and executing pull-request code, and granting an authenticated GITHUB_TOKEN can allow a malicious pull request to execute arbitrary commands with repository privileges. Direct shell interpolation of issue and pull request fields adds command-injection risk, and AWS credentials are exposed in the deployment job. Use pull_request for untrusted builds, isolate privileged deployment workflows, pass external values through environment variables with safe quoting, restrict token permissions, and pin third-party actions to commit SHAs.