Please do not open a public issue. Report vulnerabilities through GitHub private vulnerability reporting. We aim to acknowledge reports within 3 working days.

• Pin the action by full commit SHA (uses: continuous-actions/dynamic-monorepo@<sha> # v1.x.y), or at least to the v1 tag.
• Grant only contents: read. The action needs no other permission and uses no token.
• Pass matrix values to scripts through env: instead of ${{ }} interpolation inside run:.

The configuration file, git history and file names are treated as untrusted. See docs/decisions.md#security-model for the controls in place.