GitHub pull_request_target blocked by default December 2

GitHub will block pull_request_target events by default in public repositories on Free, Team and Enterprise Cloud starting December 2, 2026, a delay from the earlier November 2 date. Private, internal and Enterprise Server repositories are unaffected. The trigger runs with base-repo secrets, so executing fork code can leak them. Two brownouts, November 9 and 16 (16:00–18:00 UTC), will fail blocked runs. Teams can check Insights, then allow specific workflows through an Actions event policy. The claim check found no cited sources for these details.