Introducing Secret Exfiltration Protection for GitHub Actions

Recent supply chain attacks such as GhostAction, Megalodon, Miasma, and Hades have exploited stolen GitHub tokens to inject malicious workflows into repositories, enabling secret exfiltration via CI runners. These attacks bypass branch protection and code review by committing to temporary branches without pull requests, evading detection. The malicious workflows harvest repository secrets—including cloud credentials, SSH keys, and OIDC tokens—and exfiltrate them using seemingly legitimate GitHub Actions workflows. StepSecurity introduces a two-layer defense: blocking unreviewed workflows from accessing secrets and detecting exfiltration attempts in real time.

AI-extracted · verify before operational use