Skip to content
GitHub Forensics

This tool is not affiliated with, endorsed by or sponsored by GitHub, Inc. or Microsoft Corporation. GitHub and GitHub Actions are trademarks of GitHub, Inc. Other names are trademarks of their respective owners.

Glossary

Secret masking (Actions log redaction)

GitHub Actions replaces registered secret values with *** in run logs. Transformed values (base64, reversed, split) are not masked.

Secret masking is the GitHub Actions feature that replaces the value of each registered secret with *** when it appears in a workflow log. It matches exact strings. GitHub's secure use reference notes that redaction is not guaranteed and that transformed values must be registered separately.

So a step that pipes a secret through base64 (often twice), rev or xxd prints an unmasked string that decodes back to the secret. The tj-actions/changed-files compromise in 2025 used this to leak CI secrets into public logs. See GitHub Actions secrets leak.

This tool is not affiliated with, endorsed by or sponsored by GitHub, Inc. or Microsoft Corporation. GitHub and GitHub Actions are trademarks of GitHub, Inc. Other names are trademarks of their respective owners.