# Workflow prints a secret

A GitHub Actions run script that echoes or prints a ${{ secrets. }} expression.

Area: Security

## What you need to supply

The workflow YAML. The check does not run the workflow.

## If it reports a finding

High severity. The suggested next step is to remove the secret from the script output.

## What this does not prove

A normal run: echo "hello" is not this finding. Mentioning secrets.GITHUB_TOKEN in an env mapping, without printing it, is not this finding.

## Run script that this check is written to notice

```
run: echo ${{ secrets.API_KEY }}
```

Reading this page does not submit infrastructure. The HTML page is https://skaleagents.com/checks/workflow-prints-a-secret.