GitHub
Security & compliance
Releases
Secret value echoed in run step
Part of the Actions supply chain check · fix arrives as a pull request
What it is
A run step prints a secret — echoing a variable that holds one, or dumping the environment for debugging.
Why it matters
GitHub masks known secret values in logs, but only exact matches. Base64, JSON-wrapped, or partially printed values slip through, and workflow logs are visible to anyone with read access to the repository.
How to fix it
Remove the echo and rotate the secret, since the logs already contain it. Where debugging genuinely needs it, print a length or a hash rather than the value.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.