Signal9Signal9 — home
online
back to labs

GitHub Actions: The Leaked Variable

MediumDevOps10-15 min
The brief

A deployment pipeline prints a credential into the build logs because it's set as a plain value instead of pulled from secrets. Examine /root/project/ci.yml (workflow- and job-level env differ per session) and record the NAME of the environment variable that carries a credential as a hardcoded value — the one that should be using ${{ secrets.* }} — to /root/answers/var.txt. A credential already read from secrets is fine.

What you'll do
  • Record the hardcoded credential variable's name to /root/answers/var.txt

Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.