Security / Public reference

Workflow prints a secret

A GitHub Actions run script that echoes or prints a ${{ secrets. }} expression.

What you need to supply

The workflow YAML. The check does not run the workflow.

If it reports a finding

High severity. The suggested next step is to remove the secret from the script output.

What this does not prove

A normal run: echo "hello" is not this finding. Mentioning secrets.GITHUB_TOKEN in an env mapping, without printing it, is not this finding.

Run script that this check is written to notice

run: echo ${{ secrets.API_KEY }}

All review checks. Reading this page does not submit your infrastructure.