Guides
How to manage secrets in GitHub Actions
Secrets are sprawled across repository settings and nobody knows what is still used.
7 min read
Secrets are sprawled across repository settings and nobody knows what is still used.
Why it happens
Repository secrets are visible to every workflow, including ones triggered by pull requests, and they never expire.
How to fix it
- Use OIDC instead of stored secrets wherever the provider supports it
- Scope secrets to deployment environments with required reviewers
- Set explicit permissions on GITHUB_TOKEN — default the repository to read-only
- Audit which secrets have been read in the last 90 days and delete the rest
- Never use pull_request_target with a checkout of the PR head
Your next build could be twice as fast, at half the price
Start free. Migrating away is the same one line, and we publish that diff too.
Related
How to run CI runners inside your VPCBuilds need to reach an internal service that is not exposed publicly.How to give runners a static IPA third-party service requires IP allowlisting and hosted runner IPs change constantly.How to run security scans without slowing CIVulnerability scanning adds minutes to every pull request.How to secure your CI supply chainThird-party actions run with access to your repository and secrets.