diff --git a/.github/workflows/vulnerable.yml b/.github/workflows/vulnerable.yml
new file mode 100644
index 0000000..524a824
--- /dev/null
+++ b/.github/workflows/vulnerable.yml
@@ -0,0 +1,14 @@
+on:
+  pull_request_target:
+    types: [Created]
+jobs:
+  test:
+    environment: NeedsApproval
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout from PR branch
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
+      - run: ./cmd