Self-Hosted CI Runners Are Shared Secrets: Threat Modelling Your Build Infrastructure

A threat model for self-hosted CI runners, with the persistence chain that turns a fork pull request into production access and the controls that break it.