3 ms·
> In the next commit the PR author exfiltrates GitHub secrets by base64ing them and logging in the workflow run (or any other way). Environment secrets are not
by mhils 5y ago
> In the next commit the PR author exfiltrates GitHub secrets by base64ing them and logging in the workflow run (or any other way).
Environment secrets are not exposed to PRs, so this does not work. This really only concerns DoS.
- hashhar 5y agoIIRC I can look at the secret names in the workflow definition then pipe them through `base64 | zip` and have fun. I did this quite some time ago but they may have added better limits in place.