Proof-of-concept showing why custom GitHub Actions must call core. setSecret() on every sensitive input
proof-of-concept devsecops secuirty github-actions defense-in-depth supply-chain-security actions-toolkit credential-leak secret-masking core-setsecret
-
Updated
Sep 24, 2026 - TypeScript