Workflow write access is secret read access whenever the workflow you can write executes with access to those secrets. That condition is the whole argument, and it is narrower than the headline. Someone who can change a workflow file does not automatically hold every repository, organization or environment secret. They hold whichever secrets the platform lets that workflow reach, under whichever approval rules govern the run. Most teams have never written that mapping down, because the question they audit is who can deploy, not who can change the file that decides what deploys.

On 8 October 2026, StepSecurity reports, two compromised maintainer accounts pushed a workflow named security-audit.yml directly to default branches across 345 repositories, with no pull request and no review. This post is not the campaign's chronology.…