Comment by lmeyerov

Ah this is a good step. I hadn't looked since the env var vulns earlier in the ~year. Add in GH runner domain/vpc safelisting and a lot of the basics get solved!