SEC008 — secrets-dump

Severity: warning · Category: Security

What it checks

Flags any run:, with:, or env: value containing toJSON(secrets) (case-insensitive).

Why it matters

toJSON(secrets) serializes the entire secrets context — every secret configured on the repo, org, or environment — into a single value, even if the step only actually needs one of them. That's a much larger blast radius than necessary: a bug that logs or leaks that one value now exposes everything, not just the credential the step was written for.

Examples

Flagged:

steps:
  - name: Deploy
    run: ./deploy.sh
    env:
      ALL_SECRETS: ${{ toJSON(secrets) }}

Fixed — reference only the specific secret the step needs:

steps:
  - name: Deploy
    run: ./deploy.sh
    env:
      DEPLOY_TOKEN: ${{ secrets.DEPLOY_TOKEN }}

Suppressing

The finding is reported on the step containing the toJSON(secrets) expression:

  - name: Deploy # vlotpipe: ignore[SEC008]
    run: ./deploy.sh
    env:
      ALL_SECRETS: ${{ toJSON(secrets) }}

Hard to justify in practice — if a step legitimately needs many secrets, listing them individually is only marginally more YAML and keeps the audit trail intact.