SA-2026-006: The synthetic readers' workflow gave every secret to every step

What it is

The SG/Send token, the six vault keys and the Anthropic key were job-level environment variables, visible to unpinned pip installs, the browser installer and tag-pinned actions.

What an attacker could do

A compromised package or a moved action tag could take every secret: write access to six vaults and the Anthropic key.

How: A malicious release of a dependency reads the environment during pip install.

Root cause

Secrets were scoped to the job for convenience.

What contributed

• Packages unpinned; actions pinned to tags, which their owners can move.

What was not in place

Least privilege per step, and pinned supply chain.

The fix

Secrets only on the step that runs; packages and actions pinned (the workflow was later removed, v0.10.23).

What prevents it now

The gate fails on any workflow action not pinned to a commit SHA.