Comment by KronisLV

Where’s the bullet point about the way we do programming being horrible? Not even the work, but the tools and languages afforded to us.

github.event.issue.title is very obviously data. It should never be POSSIBLE to treat that as an instruction.

Furthermore, the idea of any code being able to access the tokens instead of allowlisted software and only with specific commands, and also no housekeeping to prevent the DATA of the token from ever being sent to anything other than a desired host… all of it feels fundamentally wrong.

The fact that our OSes don’t help with that is so saddening.