# GitHub Actions Artifacts Leak Tokens, Risk Compromising Services and Repositories 🔓

**URL:** <https://onehack.st/t/github-actions-artifacts-leak-tokens-risk-compromising-services-and-repositories/289346>\
**Category:** News & Articles\
**Tags:** hacking\
**Created:** [August 19, 2024, 12:59pm UTC](https://onehack.st/t/github-actions-artifacts-leak-tokens-risk-compromising-services-and-repositories/289346 "2024-08-19T12:59:45Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheJoker](https://onehack.st/user_avatar/onehack.st/thejoker/32/22660_2.png) [@TheJoker](https://onehack.st/u/TheJoker)\
**Post date:** [August 19, 2024, 12:59pm UTC](https://onehack.st/t/github-actions-artifacts-leak-tokens-risk-compromising-services-and-repositories/289346/1 "2024-08-19T12:59:45Z")

</div>

**Summary:**

* * *

1. **Token Leak Vulnerability**  
GitHub Actions workflows can unintentionally leak sensitive tokens for third-party services and GitHub itself through artifacts, which are stored for up to 90 days and might be publicly accessible in open source projects.

2. **Security Risks**  
Leaked tokens can be exploited by attackers to inject malicious code or access private repositories. Issues have been found in high-profile projects like firebase-js-sdk and tools used by companies such as Google and Microsoft.

3. **Mitigation Measures**  
To address these risks, a custom action has been developed to audit artifacts for secrets before upload. Users are advised to review their CI/CD workflows and limit permissions to enhance security.

**Read more at:** [Security Week](https://securityweek.com)