CICD-SEC-6 — Secrets over-provisioned to the whole workflow - Pipefort

Field	Value
Category	`CICD-SEC-6`
Severity	HIGH (toJSON) / MEDIUM (workflow env)
Confidence	HIGH
OWASP	CICD-SEC-6: Insufficient Credential Hygiene
Auto-fix	✗

What the check does

Flags two over-exposure patterns:

${{ toJSON(secrets) }} — serializes every repository and organization secret into a single value (HIGH).
Workflow-level env: bound to a secret — the value is readable by every step of every job, far wider than the one step that needs it (MEDIUM).

Why it matters

The blast radius of a credential leak is set by how widely the credential is provisioned. toJSON(secrets) means one injection, one careless echo, or one compromised action can exfiltrate the entire secret store at once. A workflow-level secret env var is present in every step, including third-party actions you don’t control.

env:
  DEPLOY_TOKEN: ${{ secrets.DEPLOY_TOKEN }}   # ← visible to every step of every job
jobs:
  a:
    steps:
      - run: echo '${{ toJSON(secrets) }}'    # ← dumps ALL secrets

Safe alternative

Bind each secret at the narrowest scope that needs it, and reference secrets individually:

jobs:
  deploy:
    steps:
      - run: ./deploy.sh
        env:
          DEPLOY_TOKEN: ${{ secrets.DEPLOY_TOKEN }}   # ← only this step