Skip to content

v1.0.3 - Security: register api-key and github-token as masked secrets

Choose a tag to compare

View all tags
@PetriLahdelma PetriLahdelma released this 03 May 20:32
· 1 commit to main since this release
v1.0.3
e76c644

Defense-in-depth fix for CWE-532 (information exposure through log files). The action now registers both api-key and github-token inputs with core.setSecret() so the runner masks them in workflow logs.

Severity: Low (CWE-532, defense in depth).

No known exploitation. GitHub already auto-masks values passed via ${{ secrets.X }}, so under normal usage the runner's primary defense was never broken. This fix covers the edge case where a workflow author passes a literal token or pulls one from a non-secret source.

Action required: bump to @v1.0.3 (or pin a SHA) at your earliest convenience.

Reported externally; researcher credit pending consent.

Assets 2
Loading