This workflow uses `pull_request_target` trigger with `secrets: inherit`, which passes all repository secrets to the reusable workflow `getsentry/craft/.github/workflows/changelog-preview.yml`. If that external workflow checks out fork code (PR head ref) and executes it, an attacker could exfiltrate secrets by opening a malicious PR. The workflow also grants elevated permissions (`contents: write`, `pull-requests: write`, `statuses: write`) which amplifies potential impact.