Skip to main content

​
What the check does

Flags two primitives inside run: steps. Full-environment enumeration — printenv, a bare env, set |, export -p, declare -x, or reading /proc/self/environ. CI-token echo — GITHUB_TOKEN, ACTIONS_TOKEN, GITHUB_JOB_TOKEN, ACTIONS_RUNTIME_TOKEN, or ACTIONS_ID_TOKEN_REQUEST_TOKEN in shell form ($GITHUB_TOKEN, ${GITHUB_TOKEN}) or as ${{ github.token }}, written to the log or into $GITHUB_OUTPUT / $GITHUB_ENV / $GITHUB_STEP_SUMMARY.

​
Why it matters

Neither is an exploit on its own. Both are the step an attacker adds after they have execution — and both are unusual enough in a real pipeline that finding one is worth a human look. By the time a script runs, every secret the job was given is an environment variable, and workflow logs are readable by anyone with read access to the repository. GitHub masks a secret only where it recognises the exact value, so a reformatted or encoded dump walks straight past masking:
A CI token is minted per run and carries the job’s write scopes. A token in the log is a token anyone watching the run can replay before it expires:

​
Safe alternative

  • Debug one variable by name, after confirming it holds nothing sensitive — never print the whole environment from a job that receives secrets.
  • Pass a token to the consuming command through env: and let that command read it. If you need to prove a token is present, print its length, not its value.

​
What does not fire

The matcher is line-oriented, anchored at a command position, and requires an output sink. That is what keeps the common innocent forms quiet without a shell parser:

​
Encoded variants

Encoding happens downstream of the primitive, so env | base64 and echo $GITHUB_TOKEN | base64 are caught by the same matcher — it anchors on the primitive at the head of the pipe. General obfuscation detection (index notation, decode-and-execute) stays with CICD-SEC-4 obfuscated expression.

​
Auto-fix

None. Deleting the line might remove a debugging aid the author wanted, and rewriting it would leave the same capability under a different spelling. The finding is the fix instruction.