Secret written into a CI definition (ARCH10033)

Key config.ci.plaintext-secret · Severity error · Category security · CWE CWE-798

A token written into .gitlab-ci.yml (top-level or job variables) or a GitHub Actions workflow (env of the workflow, a job or a step) is in the repository and its history: everyone who can read the repository has it, including every fork.

Incorrect

variables:
  DEPLOY_TOKEN: change-me-123
deploy:
  stage: deploy
  script:
    - ./deploy.sh

Correct

# DEPLOY_TOKEN is a masked variable in Settings > CI/CD > Variables.
deploy:
  stage: deploy
  script:
    - ./deploy.sh

Fix

GitLab: define it as a masked CI/CD variable in the project or group settings. GitHub: store it as a repository or environment secret and use ${{ secrets.NAME }}.

Not flagged

• References ($VAR, ${{ secrets.X }}) and empty values.
• Names that only mention a secret: TOKEN_URL, PASSWORD_FILE.