GitHub Actions leaking secrets when Miri output is cached
Rust's Miri tool stored all environment variables into target/, letting GitHub PR CI runs read cached secrets; fix ships in nightly 2026-09-22.
The Rust Security Response Team disclosed that Miri persists all environment variables to target/, which combined with GitHub Actions directory caching can expose secrets to pull request CI runs. Any contributor who previously landed a change can trigger a CI run that extracts cached secrets and cover their tracks via a second commit, since GitHub hides overwritten commits. The fix restricts Miri to preserving only CARGO_* variables (excluding tokens) and OUT_DIR, shipping in the 2026-09-22 nightly. An ecosystem scan found one affected repository; affected users should clear caches and rotate potentially leaked secrets.