robintail / incaseofmydeath Goto Github PK

Thank you for the amazing project 🙌 It's a god idea to keep death in mind, it'll come in the least expected moment.

Considering the fact that GitHub Actions aren't safe by default, is it a good idea to demonstrate sending emails with dawidd6/action-send-mail?

In theory, nothing prevents the author of that action from publishing a vulnerable tag (read more) and getting access to my emails including secret variables in them.

The safer alternative would be to use commit hash. Or, maybe there's some nice CLI solution without using any custom GitHub actions?

Thanks again and have a great day!