We Almost Leaked Secrets in GitHub Actions , What Saved Us at the Last Minute

You never forget that one moment when you realize a GitHub Action nearly leaked your AWS credentials to the entire world.

It starts as just another PR merge — and ends in a race to rotate keys before someone gets in.

That day, we were seconds away from disaster.

What Happened

We had a GitHub Actions workflow that looked like this:

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v2

      - name: Deploy to AWS
        run: ./deploy.sh

Simple, clean, and dangerous.

Because in deploy.sh, we were referencing environment variables like:

export AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID
export AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY

And guess what?

One developer added a debug line to the script:

echo "Deploying with key: $AWS_ACCESS_KEY_ID"

Boom 💥

If this had run on a public repo — or if logs had been shared — the AWS key would’ve been printed in plaintext to GitHub Actions logs.

The Realization

It was only caught because one engineer noticed the log output during a post-deploy check:

Deploying with key: AKIA1**********

We immediately shut down everything.

• Revoked the key
• Invalidated all sessions
• Killed the pipeline
• Audited all workflows

We got lucky.

Very lucky.

What Went Wrong

1. No masking of secrets in logs GitHub by default masks secrets set via the secrets block, but only if you don’t echo them directly.
2. Hardcoded secret export inside script Secrets should’ve been injected securely, not passed around in plaintext inside bash scripts.
3. No audit on workflow content Anyone could edit deploy.sh and sneak in logging lines — even accidentally.
4. Over-permissive IAM key The key had full AdministratorAccess — a blast radius just waiting to happen.

What We Did to Fix It

1. Moved All Secrets to OIDC Roles

No more static AWS keys.

We now use GitHub’s OpenID Connect (OIDC) integration to issue temporary tokens to our workflows via IAM roles.

permissions:
  id-token: write
  contents: read

steps:
  - name: Configure AWS credentials
    uses: aws-actions/configure-aws-credentials@v2
    with:
      role-to-assume: arn:aws:iam::ACCOUNT_ID:role/GitHubOIDCRole
      aws-region: us-east-1

No secrets, no risk of leak.

2. Enabled secrets.mask + audit logs

Now our GitHub Actions workflow has strict rules:

• Any secret must be set via GitHub Secrets UI
• Debug lines using secrets are auto-blocked via pre-commit hook
• We audit GitHub Action logs weekly using an internal parser for potential leaks

3. Set GitHub Environment Protection Rules

Deployments to prod now require:

• PR approval
• Code review
• Mandatory workflow_run trigger
• No direct push to main

This prevents rogue or careless pushes.

4. Used actions/secret-scanner for all commits

We added a scanner in CI to detect if any secrets (AWS, GCP, SSH) are committed — even temporarily.

What We Learned

• CI/CD pipelines are part of your attack surface
• A single echo statement can cost you thousands of dollars
• GitHub OIDC is not optional anymore — it’s the baseline
• Assume any log can be leaked — write your scripts accordingly

Final Checklist

If you’re using GitHub Actions, check today:

✅ Are you using OIDC or still pasting AWS keys? ✅ Are secrets passed into bash scripts in plaintext? ✅ Are logs monitored for accidental exposure? ✅ Are keys scoped to only what’s necessary?

The attacker isn’t always external. Sometimes, it’s your debug line that becomes the breach.

Ever almost leaked secrets via CI/CD? Drop your story in the comments — and help others avoid the same scare.

If You Like this Article then you can also Go through my other DevOps And Kubernetes Articles with the Below Links :

[embed]Kubernetes Series Please find in depth knowledge on Kubernetesmedium.com

[embed]DevOps | DevsecOps | CI/CD !! Welcome to the world of DevOps !!medium.com

!! Thanks For Reading !!

Thank you for being a part of the community

Before you go:

• Be sure to clap and follow the writer ️👏️️
• Follow us: **X | [LinkedIn](https://www.linkedin.com/company/inplainenglish/) | [YouTube](https://www.youtube.com/@InPlainEnglish) | [Newsletter](https://newsletter.plainenglish.io/) | [Podcast](https://open.spotify.com/show/7qxylRWKhvZwMz2WuEoua0) | [Twitch](https://twitch.tv/inplainenglish)**
• **Start your own free AI-powered blog on Differ** 🚀
• **Join our content creators community on Discord** 🧑🏻‍💻
• For more content, visit **plainenglish.io + [stackademic.com](https://stackademic.com/)**