Report it privately through GitHub private vulnerability reporting. Do not open a public issue.

Include the release or commit you used, the workflow or input that shows the problem, and what an attacker could gain. We reply within five working days, keep you informed while we fix it, and credit you in the advisory unless you ask us not to.

The action runs in the runner's process with the permissions of the job. It reads the files its inputs name and, for sync and render, writes inside the workspace. It never reads a token, never calls an API, and makes no network request. A path that leaves the repository, through .. or an absolute path, is refused. Diagram text is parsed, never run as code.