⚡ TL;DR: Long-lived CI credentials are a top breach vector, so stop storing secrets at all. Swap stored keys for short-lived, scoped, keyless OIDC auth, keep secrets out of logs and forked PRs, and scan for leaks before attackers find them.

Contents

A token in a log gave away production

The principle: don't store a secret at all

The picture: OIDC token exchange vs the stored key

Stored key vs OIDC vs secret manager

Build it: a GitHub Actions job with OIDC, no stored keys

Logs and forked PRs: where secrets escape

Scan for leaks before attackers do

Common mistakes that cost hours

Takeaways

Where to go next

A token in a log gave away production

A team stored a long-lived cloud access key as a CI secret so their pipeline could deploy. It worked for a year. Then someone added a debugging line, echo "deploying with $AWS_ACCESS_KEY_ID" , to a pull request. The build ran, the value landed in the public build log, and a bot scraping that CI provider had it within minutes.…