# Secrets committed to public repositories

Production env files, OAuth tokens, PATs, or PoC credentials published in repos, releases, or workflow YAML

_Area: Software supply chain and CI/CD. Seen in 3 disclosed reports; latest 2025-12-09. Updated 2026-10-23._

## How it works
A secret that should stay private is written into something that gets published: a committed env file, a packaged release artifact, a workflow YAML, or a throwaway PoC repo. The assumption that breaks is "this repo/artifact is not really public" or "the secret is masked/hidden." Once pushed, the value is readable by anyone, and any reversible transform (base64, chunking) defeats masking that only matches the literal string [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-attacks-pat-control-plane.md).

## Where it shows up
- Env/config JSON (production, staging) committed alongside source, or bundled into app packages [E2](https://bugbountylibrary.com/r/h1%3A397527.md)
- Release artifacts with no matching source, especially many binaries from one account [E2](https://bugbountylibrary.com/r/h1%3A397527.md)
- Workflow YAML referencing `${{ secrets.NAME }}` — names are enumerable via code search even when values are masked [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-attacks-pat-control-plane.md)
- Personal access tokens with ordinary dev scopes sitting in repo content or logs [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-attacks-pat-control-plane.md)
- Security/triage team orgs with predictable names and many fresh public repos, including "Retest" branches [E3](https://bugbountylibrary.com/r/h1%3A2937622.md)
- PoC or reproduction scripts pushed to public repos for private reports [E3](https://bugbountylibrary.com/r/h1%3A2937622.md)

## How to review
The invariant: no live credential value or its reversible encoding appears in any published artifact, and secret names alone do not grant access. Check that secrets are injected at runtime from a secret store, not committed; that release artifacts are scanned (unpack Electron `app.asar` and inspect bundled config) [E2](https://bugbountylibrary.com/r/h1%3A397527.md); that PATs are scoped and short-lived [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-attacks-pat-control-plane.md); and that triage/PoC repos are private or deleted after use [E3](https://bugbountylibrary.com/r/h1%3A2937622.md). Confirm masking is not the only control — assume transformed values leak [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-attacks-pat-control-plane.md).

## Variants seen
- PAT with standard dev permissions used to enumerate Action secret names and pivot to cloud credentials [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-attacks-pat-control-plane.md)
- OAuth client_secret and Slack user token shipped inside a public Electron release [E2](https://bugbountylibrary.com/r/h1%3A397527.md)
- Private-report PoCs and secrets left in public triage-team repos [E3](https://bugbountylibrary.com/r/h1%3A2937622.md)

## Impact and severity
High: full access to all Slack channels [E2](https://bugbountylibrary.com/r/h1%3A397527.md), cloud control-plane lateral movement [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-attacks-pat-control-plane.md), and exposure of private report data [E3](https://bugbountylibrary.com/r/h1%3A2937622.md). Worse when tokens are broad-scoped, long-lived, or when the repo looks innocuous (no source, many releases) so nobody reviews it [E2](https://bugbountylibrary.com/r/h1%3A397527.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-attacks-pat-control-plane.md
- E2: https://bugbountylibrary.com/r/h1%3A397527.md
- E3: https://bugbountylibrary.com/r/h1%3A2937622.md