After the Railway incident I wrote a 15-minute key rotation checklist . Rotating is step one. Step two is making sure the new keys don't leak again, and CI is one of the easiest places to leak them. Here are the three patterns I see most often, and how to fix each one. 1. Printing secrets in run: steps - run : echo "key is ${{ secrets.DEPLOY_KEY }}" - run : printf '%s\n' "${{ secrets.DB_PASSWORD }}" GitHub masks known secret values in logs, bu...