CLAIM-2026-08-21-12

GitHub's own security hardening guidance states that for inline scripts the preferred approach to handling untrusted input is to set the value of the expression to an intermediate environment variable.

Sources

• githubdocs2026security