GitHub Actions is a powerful tool, but poor configuration can turn it into a critical attack vector. In this talk, we’ll explore how common mistakes allow malicious code execution, credential leaks, and privilege escalation.