id: 124b9097-1a43-4759-892f-031f877fa794 title: CI logs publish absolute builder paths state: closed labels:
- kind:security assignees: [] milestone: null created: 2026-10-27T17:24:52.572335287Z updated: 2026-10-27T17:45:41.820786720Z
What
CI step logs are published verbatim and include absolute builder paths, e.g.:
Checking hu13 v0.1.0 (~/src/code/gl0w-w0rld/hu13)
Finished `dev` profile ...
Reproduced
/ci/index.html → 02_test.sh.log pre.
Impact
On a public deployment this leaks the builder’s home directory/username and local layout. Not a secret, but avoidable.
Fix
Redact the repo root (and its parent if needed) from captured logs at build time, e.g. replace the canonical repo path with <repo> and $HOME with ~. Keep logs otherwise byte-faithful and escaped. Test with a log containing the absolute path.