DevSecOps Engineer: 2026-09-22

1. GitHub Actions leaking secrets when Miri output is cached

   Rust Blog (Rust Security Response Team), 2026-09-21. Read, 4 min.

   The Rust Security Response Team reports that Miri stores all environment variables to the target directory, so when a GitHub Actions workflow runs cargo miri with secrets in its environment and caches that directory, pull requests that can read the cache can extract those secrets. The short-term fix makes Miri keep only Cargo environment variables, apart from Cargo token variables, and OUT_DIR, shipping in the 2026-09-22 nightly, and affected projects are advised to clear their caches and rotate any secrets that may have leaked.

   Why it matters for this role: You wire security into the pipeline, and this shows cargo miri can write environment secrets into a cached target directory that pull requests can read, so review which CI jobs expose secrets to a shared cache.

DevSecOps Engineer