SA-2026-041: The security check printed part of every secret it found

What it is

When the gate, the release tripwire or the history scan found a credential, its message quoted the first ten characters of what it found, and those messages go to the terminal and to the CI log.

What an attacker could do

Part of an AWS access key id, a token or a key in a log anyone with access to the run can read; the more of a secret is known, the less is left to guess.

How: Commit a secret by mistake; the gate refuses it and prints its first ten characters in the public Actions log.

Root cause

The finding was written to help a person locate the secret, and repeated part of it to do so.

What contributed

• The security tooling was written by the security agent and reviewed by nobody else until code scanning was switched on.

What was not in place

An independent scanner over our own security code.

The fix

Each secret pattern has a name; a finding says which kind it found ("credential shape: an Anthropic key") and never repeats a character of it.

What prevents it now

GitHub code scanning (CodeQL) now runs on every push, and push protection blocks supported secrets before they reach the repository.