---
id: 124b9097-1a43-4759-892f-031f877fa794
title: CI logs publish absolute builder paths
state: closed
labels:
- kind:security
assignees: []
milestone: null
created: 2026-10-27T17:24:52.572335287Z
updated: 2026-10-27T17:45:41.820786720Z
---
## What

CI step logs are published verbatim and include absolute builder paths, e.g.:

```
Checking hu13 v0.1.0 (~/src/code/gl0w-w0rld/hu13)
Finished `dev` profile ...
```

## Reproduced

`/ci/index.html` → `02_test.sh.log` pre.

## Impact

On a public deployment this leaks the builder’s home directory/username and local layout. Not a secret, but avoidable.

## Fix

Redact the repo root (and its parent if needed) from captured logs at build time, e.g. replace the canonical repo path with `<repo>` and `$HOME` with `~`. Keep logs otherwise byte-faithful and escaped. Test with a log containing the absolute path.