@warchantua
@pati_gallardo That's no difference to
GitHubs own runners. The same attack vector exists there.

Also for self-hosted runners you would throw them away after a build.