CI runner credential exposure
Critical
Example incident
- Status
- Needs action
- Affected
- self-hosted runner tokens
Summary
Build logs printed a self-hosted runner registration token that is still valid.
Updates
-
3h ago
Public logs confirmed
Incident brief
CI runner credential exposure
Critical · Needs action
Affected: self-hosted runner tokens
Build logs printed a self-hosted runner registration token that is still valid.
What to do:
- Revoke the printed runner token.
- Rotate secrets that the runner could read.
Sources:
- Runner advisory https://example.com/runner-token