pull_request_target is dangerous — runs with write permissions and access to secrets, but checks out the PR code. Used incorrectly, it lets attackers steal secrets. Use plain pull_request unless you know exactly what you're doing.
Don't pin actions to branches — uses: someone/action@main lets the action change under you. Pin to a tag (@v4) or a commit SHA for security.
Concurrent runs can race — use concurrency: blocks to cancel in-progress runs when a new commit lands.
Self-hosted runners on public repos are a security risk — anyone can submit a PR that runs arbitrary code on your runner. Use ephemeral runners or restrict to private repos.