What usually leaks
- npm, GitHub and cloud tokens printed by build scripts
- x-access-token URLs used for git pushes
- Usernames in runner and home directory paths
- Webhook URLs for Slack and other chat tools
Tips
- If a token appears unmasked in a public workflow log, treat it as leaked: delete the log run and rotate the token.
- Download the cleaned log and attach it, rather than pasting thousands of lines into the issue body.