Replace pull_request with pull_request_target

.github/workflows/e2e_tests.yml

@@ -3,7 +3,7 @@ name: Playwright Tests
 on:
   push:
     branches: [main]
-  pull_request:
+  pull_request_target:
     branches: [main]
 
 permissions:
@@ -20,7 +20,10 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y libwoff1
 
+      # Security: Explicitly checkout the PR's code, not the target branch
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
 
       - uses: actions/setup-node@v4
         with: