# Secrets leaked into logs and artifacts

Credentials or full request commands written to logs, CI artifacts, or web-served files

_Area: Cloud and container security. Seen in 3 disclosed reports; 2 confirmed bounties: $500 and $7,500; latest 2021-12-21. Updated 2026-10-23._

## How it works
A component serializes a whole object or request for debugging, or a deployment writes files into a served directory, and the output lands somewhere broader than the secret's intended audience. The broken assumption is that debug output, build artifacts, or deployment files stay private. In practice logs are readable by anyone with log RBAC, CI artifacts are downloadable, and web roots are public. The secret is then valid for whoever reads it.

## Where it shows up
- High-verbosity logging (klog.V(4+), debug transports) that dumps whole objects or request headers [E2](https://bugbountylibrary.com/r/h1%3A966383.md)[E3](https://bugbountylibrary.com/r/h1%3A952771.md)
- Curl-command builders that embed Authorization headers [E3](https://bugbountylibrary.com/r/h1%3A952771.md)
- CI steps uploading the checkout directory or linter logs as artifacts [E2](https://bugbountylibrary.com/r/h1%3A966383.md)
- `actions/checkout` persisting GITHUB_TOKEN into `.git` by default [E2](https://bugbountylibrary.com/r/h1%3A966383.md)
- Deployment tooling placing `.git` or config inside a publicly served web root [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-azure-app-service-source-code-leak.md)
- Platform mitigations implemented only in one stack's config file (web.config) [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-azure-app-service-source-code-leak.md)

## How to review
Trace every path where a secret-bearing object is serialized: logging, error messages, artifact upload, and files under a served directory. The invariant: a secret's bytes must never reach a sink whose readers exceed the secret's intended audience. Check that masking is applied at the point of serialization, not per-branch. For CI, confirm artifacts exclude `.git` and tokens, and that `persist-credentials` is disabled. For deployments, confirm no VCS or config files sit under the document root regardless of runtime.

## Variants seen
- Controller logs dumping full Secret objects at verbosity 4+ [E2](https://bugbountylibrary.com/r/h1%3A966383.md)
- client-go debug transport logging unmasked curl commands with bearer tokens [E3](https://bugbountylibrary.com/r/h1%3A952771.md)
- Public GitHub Actions artifacts carrying GITHUB_TOKEN, exploitable mid-run via v4 download [E2](https://bugbountylibrary.com/r/h1%3A966383.md)
- `.git` in public wwwroot on non-IIS stacks ignoring web.config [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-azure-app-service-source-code-leak.md)

## Why fixes fail
A prior fix masked headers in one logging branch but left the sibling curl-command branch unmasked [E3](https://bugbountylibrary.com/r/h1%3A952771.md). A stack-specific config rule (web.config) protected only IIS, leaving other runtimes exposed [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-azure-app-service-source-code-leak.md).

## Impact and severity
Replayable tokens allow impersonation and code push [E2](https://bugbountylibrary.com/r/h1%3A966383.md)[E3](https://bugbountylibrary.com/r/h1%3A952771.md); secret logs give low-privilege log readers credentials [E2](https://bugbountylibrary.com/r/h1%3A966383.md); source code leaked at scale [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-azure-app-service-source-code-leak.md). Severity rises with token scope, public reachability, and default-on behavior.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-azure-app-service-source-code-leak.md
- E2: https://bugbountylibrary.com/r/h1%3A966383.md
- E3: https://bugbountylibrary.com/r/h1%3A952771.md