4 ms·
Does secret scanning also apply to public GitHub Action logs and Issues (or more generally, Checks logs)? We found Action logs to be a much bigger threat now t
by dinvlad 4y ago
Does secret scanning also apply to public GitHub Action logs and Issues (or more generally, Checks logs)?
We found Action logs to be a much bigger threat now that many folks have learned not to embed secrets directly into the code and to use secret managers instead. But even then, the secrets retrieved in a step can be printed in plaintext if someone, for example, runs that step debug mode.
Issues can also accidentally leak secrets via for example, third-party code builders that print their output in an issue.
- greysteil 4y agoGitHub PM here. Right now we scan code, commit metadata, issues, and issue comments. We're expanding to other content types over time, with support for pull request bodies and comments coming in early 2023. Actions logs are on our list too, but will take a little longer. (It's worth noting that any secrets in your Actions secret store will already be redacted in any Actions logs, so those won't leak there.)
- dinvlad 4y agoThanks - and yes, this is meant for external secret management solutions like Vault, not GitHub Secrets, which are "safe" enough.
- lozenge 4y agoIt feels like there could be a GitHub action step that just means "redact this particular string output in this task and for the rest of the Action"?