GitHub Actions Is Not the Problem - Blind Trust in the Workflow Is

A new DevSecOps benchmark puts a hard number on a familiar risk: when automation treats untrusted data, privileged triggers, and third-party actions as harmless, the build pipeline becomes part of the attack surface.