Quick Notes100 words
Preventing leakage of sensitive information — quick notes
Preventing leakage — quick notes
| Fact | Detail |
|---|---|
| Log masking | Best-effort. Transformed or encoded secrets are not masked |
| Secret variables in scripts | Must be explicitly mapped via env: |
| Command-line arguments | Avoid — can appear in process listings and logs |
| Fork PR validations | Secrets withheld by default — leave it |
| Non-secret variables | Not masked, not restricted by approvals |
| Git history | A committed secret survives rotation |
Strongest control: have no secret at all — OIDC, workload identity federation, managed identities.