Use when configuring CI for a public or fork-accepting repository, or choosing runners for untrusted pull requests. Untrusted fork code must never run on a trusted self-hosted runner with access to secrets or internal network.
