git-ci-cd

No malware is present in this snippet; however, the RED example demonstrates a high-severity CI/CD trust-boundary violation. Using `pull_request_target` while checking out and executing attacker-controlled PR code, combined with injecting a deployment secret into that step’s environment, can enable secret exfiltration and credential misuse. The GOOD example mitigates the risk by keeping deploy actions in a trusted `push` flow and maintaining clearer separation of privileges.