World map

 

BM

World C4: Pipeline Shields

Secrets in logs

You will learn: how GitHub hides secrets in logs, where that stops, and what to do after a leak.

Checked with GitHub Actions 2026-10 on 31 Oct 2026

The problem

Your deploy fails. To debug it, you print the token in a step. Your repo is public. Who can read that log?

Watch

Pick an event. Press Run and watch the line.

A deploy line. One step prints the token. Its log shows Using token ***.

What happened on GitHub

Workflow file .github/workflows/deploy.yml

name: Deploy
on:
push:
branches: [main]
permissions:
contents: read
jobs:
deploy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- run: npm ci
- run: echo "Using token ${{ secrets.CLOUDFLARE_API_TOKEN }}"
- run: npx wrangler deploy
env:
CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}

The line

Push to main · main

Run it, then tap the echo station to read its log. GitHub swapped the token for ***. This is masking: Blacking out a secret in the logbook: GitHub shows *** instead of the exact secret text.: a black marker in the logbook.

Watch

The mask only finds the exact secret text. Change the text, and it slips past. Hidden, or leaked?

Swipe right for good, left for needs work. Or use the buttons.

1 / 4

A step prints $TOKEN as it is

Try it

Made a new secret value in a step? Mask it yourself, before anything prints it.

Tap the line that tells GitHub to hide the new value.

0 of 1 found

Predict

A real token shows up in a public log, not masked. What do you do first?

Check

Clean up after the leak. Put the steps in order.

First step at the top. Put these in order. Use the arrows, or drag.

  • Delete the logs of that run
  • Remove the line that printed it
  • Revoke the leaked secret and make a new one
  • Save the new value as the repo secret

You did it!

You can now keep secrets out of logs, and clean up leaks.

Go deeper (optional)

The tj-actions attack printed secrets encoded twice, so masks missed them. Also: never pass a secret on the command line. Other programs on the runner can see it. Pass it in env:. Stuck later? The Rescue Center has a “secret printed in logs” flow.