Comment by gebalamariusz

Generally, yes, the guidelines specify scope to repos and branches. However, the main problem is that the default policy only checks the recipient declaration when creating an OIDC. If you didn't manually create the second condition, you were/are vulnerable to this bug. And unless someone manually fixed it and created the policy before June 2025, you will still be vulnerable.