What is a common mistake when working with GitHub Actions workflows?

A common mistake with GitHub Actions workflows is running privileged secrets or write tokens in workflows triggered by untrusted pull-request code can expose credentials or allow repository modification. The safer approach is to design and test the behavior explicitly rather than assuming the platform or dependency will handle it automatically.