Unrelated, but another interesting one is any non-admin contributors being able to add (and I believe update) secrets in a private repo for use in GH actions. It can’t be done via the UI, but can be done via the API or VSCode extension.
When I looked into it a while back, apparently it is intended behavior, which just seems odd.
When I looked into it a while back, apparently it is intended behavior, which just seems odd.