After the Railway incident I wrote a 15-minute key rotation checklist . Rotating is step one. Step two is making sure the new keys don't leak again, and CI is one of the easiest places to leak them.

Here are the three patterns I see most often, and how to fix each one.

1. Printing secrets in run: steps

- run : echo "key is ${{ secrets.DEPLOY_KEY }}" - run : printf '%s\n' "${{ secrets.DB_PASSWORD }}"

Enter fullscreen mode

Exit fullscreen mode

GitHub masks known secret values in logs, but masking is best-effort. If the value is base64-encoded, split, URL-encoded or otherwise transformed, the masked form no longer matches and the real value can show up in the log.

Fix: never echo secrets.…