[{"data":1,"prerenderedAt":365},["ShallowReactive",2],{"globals":3,"cookie-settings":230,"post-gheist-github-actions-secrets":263},{"id":4,"title":5,"description":6,"logo_light":7,"logo_dark":7,"address":7,"contact_email":8,"contact_phone":7,"header_menu":9,"footer_menu":10,"favicon":7,"public_url":11,"meta_title":12,"meta_description":13,"robots":14,"head_scripts":15,"body_scripts":16,"default_header":17,"default_footer":196,"social_links":7},1,"CredenShare","Secure credential sharing for modern teams. Encrypted in your browser, with time-limited, access-controlled links.",null,"hello@credenshare.io","fafb0437-6fc7-409e-bcce-a2519eacef43","96f782ae-6d59-4601-abd1-a4fca64cc4de","https://credenshare.io","CredenShare - Secure Credential Sharing","Share passwords, API keys and secrets securely with CredenShare. Encrypted in your browser, time-limited access, and detailed access logs.","# CredenShare Robots.txt\nUser-agent: *\nAllow: /\n\n# Sitemap\nSitemap: https://credenshare.io/sitemap.xml\n\n# Disallow admin paths\nDisallow: /api/\nDisallow: /admin/\nDisallow: /dev/\n\n# Allow main content\nAllow: /blog/\nAllow: /features/\nAllow: /pricing/\nAllow: /security/\nAllow: /docs/\n\n# Crawl-delay\nCrawl-delay: 1\n",[],[],{"id":18,"sort":7,"user_created":19,"date_created":20,"user_updated":19,"date_updated":21,"name":22,"logo":7,"show_cta":23,"cta_label":24,"cta_link":25,"cta_style":26,"sticky":23,"transparent":27,"navigation":28},"d16d4c9e-b3f8-4ea8-988b-eab863efb29c","e7d5f744-1dbd-47ad-9e01-63a9303d109e","2026-02-03T16:36:10.957Z","2026-08-17T22:46:13.371Z","Default Header",true,"Get Started","https://app.credenshare.io/register","primary",false,{"id":9,"sort":7,"user_created":19,"date_created":29,"user_updated":7,"date_updated":7,"title":30,"location":31,"items":32},"2026-02-03T16:36:40.078Z","Main Navigation","main-menu",[33,44,52,56,64,72,80,87,90,97,106,113,118,125,133,138,145,153,161,169,172,180,188],{"id":34,"sort":35,"user_created":19,"date_created":36,"user_updated":19,"date_updated":37,"label":38,"type":39,"url":40,"parent":41,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":42,"description":43,"badge":7},"157a8094-f17f-4348-bd73-774c0573b088",0,"2026-10-04T15:58:24.950Z","2026-10-23T23:13:13.022Z","Guides & Templates","custom","/resources","bf76488c-e318-48a2-8561-c32f76c61383","i-heroicons-document-text","Free practical guides and checklists",{"id":45,"sort":4,"user_created":19,"date_created":46,"user_updated":7,"date_updated":7,"label":47,"type":39,"url":48,"parent":49,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":50,"description":51,"badge":7},"1ee916dd-34a1-41fc-ad80-64681d2440ed","2026-02-11T11:19:14.086Z","Features","/features","0a887c3c-a748-4217-9e34-daf852801d4e","i-heroicons-sparkles","Everything CredenShare offers",{"id":49,"sort":4,"user_created":19,"date_created":53,"user_updated":7,"date_updated":7,"label":54,"type":55,"url":7,"parent":7,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":7,"description":7,"badge":7},"2026-02-11T11:19:13.606Z","Product","dropdown",{"id":57,"sort":4,"user_created":19,"date_created":58,"user_updated":7,"date_updated":7,"label":59,"type":39,"url":60,"parent":61,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":62,"description":63,"badge":7},"fd3cae1e-592b-413d-91e5-b1258e0aff49","2026-02-11T11:19:16.508Z","Team Onboarding","/solutions/team-onboarding","daee37a1-a164-4b63-be67-1f91e4e9b497","i-heroicons-user-plus","Securely onboard new team members",{"id":65,"sort":4,"user_created":19,"date_created":66,"user_updated":7,"date_updated":7,"label":67,"type":39,"url":68,"parent":41,"post":7,"navigation":9,"target":69,"classes":7,"page":7,"icon":70,"description":71,"badge":7},"0bacbbcf-acfb-4054-94dd-b3388ed7f576","2026-10-23T23:13:21.028Z","Compare","/compare","_self","i-heroicons-scale","Password managers and sharing tools compared",{"id":73,"sort":74,"user_created":19,"date_created":75,"user_updated":7,"date_updated":7,"label":76,"type":39,"url":77,"parent":61,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":78,"description":79,"badge":7},"63e46db0-4bed-4f24-b7bd-a79e821f3d89",2,"2026-02-11T11:19:16.976Z","Third-Party Access","/solutions/third-party-access","i-heroicons-users","Safe contractor credentials",{"id":81,"sort":74,"user_created":19,"date_created":82,"user_updated":7,"date_updated":7,"label":83,"type":39,"url":84,"parent":41,"post":7,"navigation":9,"target":69,"classes":7,"page":7,"icon":85,"description":86,"badge":7},"704e9cab-d404-4b7a-b5c1-d8d66aa45862","2026-10-23T23:13:21.131Z","How-to Guides","/guides","i-heroicons-light-bulb","Share passwords and secrets safely",{"id":61,"sort":74,"user_created":19,"date_created":88,"user_updated":7,"date_updated":7,"label":89,"type":55,"url":7,"parent":7,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":7,"description":7,"badge":7},"2026-02-11T11:19:16.058Z","Solutions",{"id":91,"sort":74,"user_created":19,"date_created":92,"user_updated":7,"date_updated":7,"label":93,"type":39,"url":94,"parent":49,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":95,"description":96,"badge":7},"6eb63ded-6ac9-4595-a55f-8795b193fe04","2026-02-11T11:19:14.648Z","How It Works","/how-it-works","i-heroicons-play-circle","See CredenShare in action",{"id":98,"sort":99,"user_created":19,"date_created":100,"user_updated":19,"date_updated":101,"label":102,"type":39,"url":103,"parent":41,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":104,"description":105,"badge":7},"8a9a4df2-3f19-4897-948a-a4d520b9389b",3,"2026-02-11T11:19:20.202Z","2026-10-23T23:13:13.401Z","Documentation","https://docs.credenshare.io","i-heroicons-book-open","Guides and API reference",{"id":107,"sort":99,"user_created":19,"date_created":108,"user_updated":7,"date_updated":7,"label":109,"type":39,"url":110,"parent":61,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":111,"description":112,"badge":7},"1cf2f869-1bb4-447a-b9d7-738b45995379","2026-02-11T11:19:17.466Z","Credential Collection","/solutions/secure-requests","i-heroicons-inbox-arrow-down","Request credentials securely",{"id":114,"sort":99,"user_created":19,"date_created":115,"user_updated":7,"date_updated":7,"label":116,"type":39,"url":117,"parent":7,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":7,"description":7,"badge":7},"790829b5-6e85-45a2-b729-01a224f1c816","2026-02-11T11:19:18.867Z","Pricing","/pricing",{"id":119,"sort":99,"user_created":19,"date_created":120,"user_updated":7,"date_updated":7,"label":121,"type":39,"url":122,"parent":49,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":123,"description":124,"badge":7},"5c9151ac-94e1-4d54-8032-768568b9ad02","2026-02-11T11:19:15.116Z","Security","/security","i-heroicons-shield-check","Our security architecture",{"id":126,"sort":127,"user_created":19,"date_created":128,"user_updated":7,"date_updated":7,"label":129,"type":39,"url":130,"parent":49,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":131,"description":132,"badge":7},"d7882f47-9f94-4860-93df-0025ff5ac8bc",4,"2026-02-11T11:19:15.577Z","Integrations","/integrations","i-heroicons-puzzle-piece","Slack, API, and more",{"id":134,"sort":127,"user_created":19,"date_created":135,"user_updated":7,"date_updated":7,"label":136,"type":39,"url":137,"parent":7,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":7,"description":7,"badge":7},"e696e64d-65e1-4b67-aef9-60db78b9f4cf","2026-02-11T11:19:19.313Z","Blog","/blog",{"id":139,"sort":127,"user_created":19,"date_created":140,"user_updated":7,"date_updated":7,"label":141,"type":39,"url":142,"parent":61,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":143,"description":144,"badge":7},"2ac2df39-fbae-45a2-b87a-313bebb4a87b","2026-02-11T11:19:17.957Z","Development Teams","/solutions/development-teams","i-heroicons-code-bracket-square","Secure credentials for dev workflows",{"id":146,"sort":127,"user_created":19,"date_created":147,"user_updated":19,"date_updated":148,"label":149,"type":39,"url":150,"parent":41,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":151,"description":152,"badge":7},"719ce073-d71f-4450-b45a-f08a05db21b2","2026-02-11T11:19:20.640Z","2026-10-23T23:13:13.301Z","About","/about","i-heroicons-information-circle","Our mission and team",{"id":154,"sort":155,"user_created":19,"date_created":156,"user_updated":7,"date_updated":7,"label":157,"type":39,"url":158,"parent":61,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":159,"description":160,"badge":7},"e18246ff-9a00-449a-88f8-09490a3cead2",5,"2026-08-24T23:17:28.605Z","Vendor Access","/solutions/vendor-access","i-heroicons-building-office-2","Share credentials with outside vendors",{"id":162,"sort":155,"user_created":19,"date_created":163,"user_updated":19,"date_updated":164,"label":165,"type":39,"url":166,"parent":41,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":167,"description":168,"badge":7},"567bc13d-4499-4dc5-a346-5eba54c1c500","2026-02-11T11:19:21.085Z","2026-10-23T23:13:13.212Z","Tools","/tools","i-heroicons-wrench-screwdriver","Free security & developer tools",{"id":41,"sort":155,"user_created":19,"date_created":170,"user_updated":7,"date_updated":7,"label":171,"type":55,"url":7,"parent":7,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":7,"description":7,"badge":7},"2026-02-11T11:19:19.768Z","Resources",{"id":173,"sort":174,"user_created":19,"date_created":175,"user_updated":7,"date_updated":7,"label":176,"type":39,"url":177,"parent":61,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":178,"description":179,"badge":7},"99bda669-3c3a-4521-815b-a1eb22a4098e",6,"2026-08-24T23:17:28.791Z","AI Agents","/solutions/ai-agents","i-heroicons-cpu-chip","Give agents scoped, expiring credentials",{"id":181,"sort":174,"user_created":19,"date_created":182,"user_updated":19,"date_updated":183,"label":184,"type":39,"url":185,"parent":41,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":186,"description":187,"badge":7},"1f787a64-8e12-484d-ae97-b6349bc82e52","2026-02-11T11:19:21.524Z","2026-10-23T23:13:13.121Z","Pastebin","https://paste.credenshare.io","i-heroicons-clipboard-document","Secure encrypted pastebin",{"id":189,"sort":190,"user_created":19,"date_created":191,"user_updated":19,"date_updated":192,"label":193,"type":39,"url":194,"parent":61,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":159,"description":195,"badge":7},"1f06247b-4633-4341-a388-95ffa524a27a",7,"2026-02-11T11:19:18.416Z","2026-08-24T23:17:03.952Z","Enterprise","/enterprise","Compliance and audit-ready security",{"id":197,"sort":7,"user_created":19,"date_created":198,"user_updated":19,"date_updated":199,"name":200,"logo":7,"tagline":201,"show_social":23,"copyright_text":202,"show_newsletter":23,"newsletter_heading":203,"newsletter_description":204,"navigation_columns":205,"bottom_links":206},"355d9ac1-c909-4cda-9071-cd3abb00a0b5","2026-02-03T16:36:11.825Z","2026-11-02T14:01:12.933Z","Default Footer","Secure credential sharing for modern teams.","© {year} CredenShare Inc. All Rights Reserved.","Stay updated","Credential incidents explained and practical guides, every two weeks. Unsubscribe any time.",[],{"id":207,"sort":7,"user_created":19,"date_created":208,"user_updated":7,"date_updated":7,"title":209,"location":210,"items":211},"861b9a44-206d-4778-9251-f5269206fdf9","2026-02-03T16:36:41.786Z","Legal Links","legal-menu",[212,218,224],{"id":213,"sort":4,"user_created":19,"date_created":214,"user_updated":19,"date_updated":215,"label":216,"type":39,"url":217,"parent":7,"post":7,"navigation":207,"target":7,"classes":7,"page":7,"icon":7,"description":7,"badge":7},"3e16a067-ce9f-4e4d-aea6-7a602094f9df","2026-02-03T16:37:32.902Z","2026-08-25T00:24:57.325Z","Terms of Service","/legal/terms",{"id":219,"sort":74,"user_created":19,"date_created":220,"user_updated":19,"date_updated":221,"label":222,"type":39,"url":223,"parent":7,"post":7,"navigation":207,"target":7,"classes":7,"page":7,"icon":7,"description":7,"badge":7},"6e9bc58b-b6d0-46f8-8c7b-123ea3273f5b","2026-02-03T16:37:32.360Z","2026-08-25T00:24:57.850Z","Privacy Policy","/legal/privacy",{"id":225,"sort":99,"user_created":19,"date_created":226,"user_updated":19,"date_updated":227,"label":228,"type":39,"url":229,"parent":7,"post":7,"navigation":207,"target":7,"classes":7,"page":7,"icon":7,"description":7,"badge":7},"78a410a6-802d-4920-a915-d8e5d2155f0c","2026-02-03T16:37:33.462Z","2026-08-25T00:24:59.086Z","Cookie Policy","/legal/cookies",{"enabled":23,"banner_position":231,"banner_title":232,"banner_text":233,"accept_all_text":234,"decline_all_text":235,"preferences_text":236,"save_preferences_text":237,"policy_page":238,"privacy_page":240,"categories":242,"id":4},"bottom","We value your privacy","We use cookies to enhance your browsing experience, serve personalized content, and analyze our traffic. By clicking \"Accept All\", you consent to our use of cookies.","Accept All","Decline All","Manage Preferences","Save Preferences",{"slug":239},"legal/cookies",{"slug":241},"legal/privacy",[243,248,253,258],{"id":244,"name":245,"key":246,"description":247,"required":23,"default_enabled":23},"1","Essential","essential","Required for the website to function. Cannot be disabled.",{"id":249,"name":250,"key":251,"description":252,"required":27,"default_enabled":27},"2","Analytics","analytics","Help us understand how visitors interact with our website.",{"id":254,"name":255,"key":256,"description":257,"required":27,"default_enabled":27},"3","Marketing","marketing","Used to deliver relevant advertisements and track campaign performance.",{"id":259,"name":260,"key":261,"description":262,"required":27,"default_enabled":27},"4","Preferences","preferences","Remember your settings and preferences for a better experience.",{"id":264,"status":265,"sort":7,"user_created":19,"date_created":266,"user_updated":19,"date_updated":267,"date_published":267,"user_published":19,"date_scheduled_publish":267,"title":268,"slug":269,"seo":270,"excerpt":278,"tags":279,"categories":292,"blocks":298,"featured_image":345,"author":359},"6b85ec56-b398-49d3-8acc-15a885610694","published","2026-10-27T14:54:25.966Z","2026-10-27T15:01:41.478Z","Gheist: stolen GitHub tokens are dumping Actions secrets into workflow logs","gheist-github-actions-secrets",{"title":271,"meta_description":272,"no_index":27,"no_follow":27,"og_title":273,"og_description":273,"og_image":7,"sitemap_change_frequency":274,"sitemap_priority":275,"additional_fields":276},"Gheist: stolen GitHub tokens used to dump Actions secrets","Wiz traced 850+ compromised GitHub accounts planting workflows that print repository secrets to logs. How Gheist works and what to check and rotate now.","","monthly",0.6,{"canonical_url":277},"https://credenshare.io/blog/gheist-github-actions-secrets","A campaign tracked by Wiz Research uses stolen GitHub tokens to plant workflows that print repository secrets into their own logs. How it works, why private repositories were exposed, and what to check and rotate now.",[280,287],{"tags_id":281},{"id":282,"status":283,"user_created":19,"date_created":284,"user_updated":7,"date_updated":7,"slug":285,"name":286},"26cdb14a-ced0-4366-b112-7370c97f4026","draft","2026-02-09T19:40:46.566Z","credentials","Credentials",{"tags_id":288},{"id":289,"status":283,"user_created":19,"date_created":290,"user_updated":7,"date_updated":7,"slug":291,"name":121},"c3b30a85-9580-418c-953e-cf29032755a0","2026-02-09T19:40:48.946Z","security",[293],{"categories_id":294},{"id":295,"status":283,"sort":7,"user_created":19,"date_created":296,"user_updated":7,"date_updated":7,"parent":7,"name":121,"description":297,"image":7,"slug":291},"53da492a-49b5-4508-92b5-fe173c23891d","2026-02-09T19:40:43.953Z","Deep dives into encryption, data protection, and credential security.",[299,306,319],{"id":300,"collection":301,"item":302},61,"block_markdown",{"id":303,"sort":7,"user_created":19,"date_created":304,"user_updated":7,"date_updated":7,"content":305},"66fbd397-9214-4fa1-a15e-697796f79568","2026-10-27T14:54:25.973Z","*What we know as of October 27, 2026, from Wiz Research's report published on October 25. We will update this post as more is disclosed.*\n\nWiz Research has been tracking a campaign it calls Gheist since September 15. It takes GitHub tokens that have already been stolen and uses each one to plant a small workflow in every repository the token can reach. The workflow's only job is to print the repository's secrets into its own log, where the attacker reads them through GitHub's API before deleting the run seconds later. Wiz says it has recovered more than 13,500 planted branches from more than 850 compromised accounts, from personal projects to private repositories in enterprise organisations, and that the activity was still ongoing and evolving as of October 24.\n\nIt is worth understanding in detail, because nothing in it is exotic. It turns ordinary push access into access to every secret a repository's workflows can see.\n\n## How does the Gheist attack work?\n\nFor each repository, the tool creates a branch named `ci-sync-` followed by six random characters, and commits a workflow file, `.github/workflows/sync-check.yml`, with the message \"ci: sync config\". The commit is authored as the token's owner, so to GitHub it looks like that person pushed it. The push triggers the workflow, which dumps the runner's environment and the repository's secrets to the log, encoded in base32.\n\nThe encoding is the trick. As Wiz explains, GitHub masks a secret in a log only when the exact value appears. An encoded secret no longer matches, so it prints in full. Restricting the job's permissions doesn't help either: it limits what the job's own `GITHUB_TOKEN` can do, but not which secrets the job can read. Where a repository has deployment environments, a later variant runs the dump once per environment, which pulls out environment-scoped secrets too, and those are often production credentials. Because everything leaves through GitHub's own API, there is no suspicious domain or outbound connection for a firewall to catch.\n\nWiz also describes a second job, added on October 19, that targets repositories with self-hosted runners and searches the runner host itself for tokens, private keys, `.env` files, cloud instance credentials and Kubernetes service account tokens. Wiz notes that this job is buggy, but the intent is clear: a self-hosted runner reached this way should be treated as compromised.\n\n## Why didn't it work everywhere?\n\nSince July 28, GitHub has held potentially malicious workflow runs in public repositories until a collaborator approves them. Wiz reports that every public Gheist run it checked was stuck waiting for that approval, so the payload never ran. That hold does not apply to private repositories or to GitHub Enterprise Server. There, Wiz found runs on `ci-sync-` branches completing and then being deleted, and in some organisations, hours later, cloud credentials from the same organisation being used to enumerate AWS Secrets Manager.\n\nThe tokens themselves came from somewhere else first. The sources Wiz could trace are infostealer logs and tokens exposed in earlier supply-chain compromises, and the same accounts turn up in other campaigns too. A stolen token rarely serves only one attacker.\n\n## What should you do now?\n\nIf your organisation uses GitHub Actions with private repositories, Wiz's report gives a clear checklist, and the essentials are short.\n\n1. **Hunt.** Look for branches matching `ci-sync-` plus six characters whose only change adds `sync-check.yml`, for workflow runs on those branches deleted within a minute of finishing, and for the user agent `gheist` in your GitHub audit log. If your workflows reach the cloud through OIDC, look in your cloud audit logs for role assumptions whose subject includes a `ci-sync-` branch.\n2. **Respond.** Rotate every repository, organisation and environment secret that an affected repository could reach. Deleting the branch or the run does not undo the exposure. Revoke the tokens that pushed the commits and check their owners' machines for infostealers.\n3. **Harden.** Require reviewers on environments that hold production secrets, scope OIDC trust to protected branches or environments, and replace long-lived personal access tokens with GitHub Apps or short-lived fine-grained tokens.\n\n## What is the lesson for everyone else?\n\nGheist is a reminder that a secret stored in CI is only as private as the least protected token with push access to that repository. The secrets were not leaked by careless code; they were read by a workflow anyone with push rights could have written. Two habits limit the damage. The first is to keep high-value secrets behind something a pushed commit cannot reach on its own, such as required reviewers on environments or OIDC trust that only protected branches can use. The second is to keep secrets short-lived, so that what leaks expires before it can be reused.\n\nRotation is also the step that tends to go wrong under pressure. When you rotate a dozen secrets in an afternoon, the new values have to reach the people and systems that need them, and the quickest channel is usually a chat window. If you are handing replacement credentials to teammates or contractors, send them in a link that expires rather than as a message that stays in history. Our guide to [sharing .env files with your team](/guides/share-env-files) covers when you need a sync tool and when a one-off handoff is enough, and [the secret zero problem](/blog/secret-zero-problem) covers the first credential every secrets manager still needs.\n\n**Updates:** none yet.\n\n---\n\n**Sources** (checked on October 27, 2026):\n[Wiz Research: Gheist, attempted scaled abuse of stolen GitHub tokens (October 25, 2026)](https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles) ·\n[GitHub: using secrets in GitHub Actions](https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions) ·\n[GitHub: OpenID Connect in GitHub Actions](https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/about-security-hardening-with-openid-connect)\n\n*Product names are trademarks of their respective owners. CredenShare is not affiliated with them.*",{"id":307,"collection":308,"item":309},62,"block_newsletter",{"id":310,"sort":7,"user_created":19,"date_created":311,"user_updated":7,"date_updated":7,"headline":312,"description":313,"placeholder_text":314,"button_text":315,"button_style":26,"form_action":7,"success_message":316,"error_message":317,"layout":318,"show_name_field":7,"background_color":7,"text_color":7,"style":7},"fda1a817-ccca-480f-9907-285ef87472ef","2026-10-27T14:54:26.014Z","Get the next one in your inbox","Every two weeks: one credential incident explained, three things worth knowing, and the practical steps from our latest guides. Unsubscribe any time.","Your work email","Subscribe","Almost there: check your inbox for a confirmation link.","Something went wrong. Please try again.","card",{"id":320,"collection":321,"item":322},63,"block_cta",{"id":323,"sort":7,"user_created":19,"date_created":324,"user_updated":7,"date_updated":7,"headline":325,"description":326,"alignment":327,"layout":328,"background_type":329,"background_color":7,"background_image":7,"gradient_start":330,"gradient_end":331,"gradient_direction":332,"text_color":7,"style":7,"buttons":333},"588536b8-c911-4ca8-8670-ee87ab8d05ec","2026-10-27T14:54:26.039Z","Rotating secrets? Hand the new ones over in links that expire","Free plan: 3 shares a day, encrypted in your browser.","center","stacked","gradient","#4c1d95","#7c3aed","to-right",[334,340],{"id":335,"sort":4,"user_created":19,"date_created":336,"user_updated":7,"date_updated":7,"cta_id":323,"label":337,"url":338,"variant":339,"size":7,"icon":7,"open_new_tab":7},"5beff425-d116-4857-b728-ab9c53f6e6f6","2026-10-27T14:54:26.065Z","Get started free","https://app.credenshare.io/register?utm_source=credenshare.io&utm_medium=blog&utm_campaign=gheist-github-actions-secrets","solid",{"id":341,"sort":74,"user_created":19,"date_created":342,"user_updated":7,"date_updated":7,"cta_id":323,"label":343,"url":84,"variant":344,"size":7,"icon":7,"open_new_tab":7},"c0f0fa05-3f6a-4494-a23a-231bf5fa8fbc","2026-10-27T14:54:26.077Z","Read the guides","outline",{"id":346,"storage":347,"filename_disk":348,"filename_download":349,"title":350,"type":351,"folder":7,"uploaded_by":19,"created_on":352,"modified_by":7,"modified_on":353,"charset":7,"filesize":354,"width":355,"height":356,"duration":7,"embed":7,"description":7,"location":7,"tags":7,"metadata":357,"focal_point_x":7,"focal_point_y":7,"tus_id":7,"tus_data":7,"uploaded_on":358},"ae371b44-c0c5-4145-b8ea-a89464a918bc","s3","ae371b44-c0c5-4145-b8ea-a89464a918bc.png","blog-gheist-github-actions-secrets.png","Gheist: stolen GitHub tokens are dumping Actions secrets into workflow logs (illustration)","image/png","2026-10-27T14:54:25.599Z","2026-10-27T14:54:25.867Z","445615",1600,900,{},"2026-10-27T14:54:25.865Z",{"id":360,"status":265,"sort":7,"user_created":19,"date_created":361,"user_updated":19,"date_updated":362,"name":5,"bio":363,"slug":364,"social_links":7,"seo":7,"avatar":7},"5fd13617-6298-4746-90f0-1c5c09ae18a3","2026-02-09T19:40:40.523Z","2026-02-09T19:43:37.635Z","The CredenShare team writes about secure credential sharing, password management, and enterprise security best practices.","credenshare",1794237319959]