Steps to reproduce
- Open an issue from an external account.
- Inspect the titles workflow.
Actual result
The title action receives the repository OpenAI secret and attacker controlled text.
Expected result
Do not expose reusable secrets to third-party actions on issue creation.
Evidence
The workflow contains the opened issue trigger and the OpenAI secret input.
Steps to reproduce
Actual result
The title action receives the repository OpenAI secret and attacker controlled text.
Expected result
Do not expose reusable secrets to third-party actions on issue creation.
Evidence
The workflow contains the opened issue trigger and the OpenAI secret input.