From 3d29d97305dcba6e558a950dacf32a027f5acef0 Mon Sep 17 00:00:00 2001
From: Oscar Carter-South <13194805+Mondotrasho@users.noreply.github.com>
Date: Sun, 9 Aug 2026 08:53:47 +1000
Subject: [PATCH] fix(ci): allow OWASP scanner on fork pull requests

---
 .github/workflows/owasp.yml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/owasp.yml b/.github/workflows/owasp.yml
index c84461d77..26c9e55d2 100644
--- a/.github/workflows/owasp.yml
+++ b/.github/workflows/owasp.yml
@@ -1,7 +1,8 @@
 name: OWASP PR Scanner
 
 on:
-  pull_request_target:
+  pull_request:
+    branches: [main]
     types: [opened, synchronize, reopened]
 
 permissions:
@@ -109,6 +110,8 @@ jobs:
           fi
 
       - name: Comment PR
+        if: github.event.pull_request.head.repo.full_name == github.repository
+        continue-on-error: true
         uses: peter-evans/create-or-update-comment@v4
         with:
           issue-number: ${{ github.event.pull_request.number }}
@@ -130,4 +133,4 @@ jobs:
       - name: Safe to merge
         if: steps.owasp.outputs.vulnerabilities_found == 'false'
         run: |
-          echo "✅ No vulnerabilities found. Safe to merge."
\ No newline at end of file
+          echo "✅ No vulnerabilities found. Safe to merge."