Authorized Mozilla bug-bounty PoC. Default branch ships .taskcluster.yml v1 with policy.pullRequests=public_restricted. An untrusted (non-collaborator) fork PR that keeps v1 must get the :pull-request-untrusted role; a fork PR whose head .taskcluster.yml is version:0 illegitimately gets the trusted :pull-request role (see poc/v0.taskcluster.yml).
sys0xFF/tc-pr-scope-poc
Folders and files
| Name | Name | Last commit date | ||
|---|---|---|---|---|