News for hackers. Stuff that matters.

A comment on GitHub Actions issued GitHub_TOKEN disclosure in GitHub Actions logs. Parent comment

Re:GitHub Actions issued GitHub_TOKEN disclosure in GitHub A... by securesaml on Wednesday May 13, 2026 @05:27PM (#48127860)
Nice find. The tokens being leaked in actions log was not one of the security implications I thought of when they released the feature.

How many other actions/libraries do you think are vulnerable?

[ Parent | on HN ]
Re:GitHub Actions issued GitHub_TOKEN disclosure in GitHub A... by damienwebdev on Thursday May 14, 2026 @10:08AM (#48135659)
I don't have an exact count, but during my analysis, I found that ~40 of the top 100 starred repos in the PHP ecosystem were impacted. Primarily by jobs that run `on: schedule` or by a maintainer with an `on: push`
[ Parent | on HN ]