What happens if a secret value accidentally appears in workflow step output?
Select an answer to reveal the explanation.
Short Explanation and Infographic
GitHub watches the log stream and replaces known secret values with '***' before they're stored — but it's not foolproof with encoded values.
Full explanation below image
Full Explanation
GitHub Actions automatically masks registered secret values in workflow logs by replacing them with '***'. This applies to secrets accessed via the 'secrets' context. However, masking has limitations: base64-encoded or otherwise transformed secrets may not be masked if the transformation changes the value. You can also manually register custom values for masking using '::add-mask::value' workflow command. The workflow does not fail or rotate secrets on exposure. Secret masking is a last defense — the real protection is not printing secrets in the first place.