Introducing Secret Exfiltration Protection for GitHub Actions

STEPSECURITY has introduced a new feature to protect GitHub Actions from secret exfiltration attacks by blocking and detecting malicious workflows. Over recent years, several campaigns have exploited vulnerabilities in CI/CD pipelines to harvest sensitive secrets using compromised developer tokens. The blog discusses major incidents, including the GhostAction and Megalodon attacks, which compromised thousands of repositories by bypassing existing branch protection and code review mechanisms.

The protection mechanism employs two key layers: a Secret Exfiltration Policy that prevents unreviewed workflows from accessing secrets, and a detection system that flags suspicious activities during workflow runs. Users can enable alerts for detection attempts. The overall approach emphasizes a defense-in-depth strategy, reinforcing the need for both proactive blocking and reactive monitoring.