Secret leakage in a cloud CI/CD tool

Summary

Under certain conditions multiline secrets are not masked in log output. Because build logs may be viewable on public repositories, cloud access keys may leak.

Impact

With leaked keys, resources can be created in the cloud account and data read.

Recommendation

Define keys as single-line values, use short-lived OIDC credentials and scan historical logs.