## GitHub Actions leaking secrets when Miri output is cached

- 種別: release
- 関連技術: rust, actions
- 公開日時: 2026-09-21T00:00:00.000Z
- 情報源: Rust Blog (https://blog.rust-lang.org/2026/09/21/github-actions-leaking-secrets-when-miri-output-is-cached/)
- パーマリンク: https://vulnpulse.app/items/rust-blog-a85667694317

The Rust Security Response Team was notified that Miri stores all environment variables to target/ , allowing secrets to persist in caches. While not necessary a vulnerability in and of itself, when paired with GitHub Actions caching behavior, it is possible for this to expose secrets to PRs. Overview GitHub Actions makes it possible to cache directories between runs. Typical setups allow CI runs on main (and other branches) to write to cache, and PRs can only read from cache (preventing cache poisoning). Rust projects tend to speed up CI by caching binaries built by cargo install and sometim…