1 comment

[ 0.25 ms ] story [ 6.3 ms ] thread

    The Rust Security Response Team was notified that Miri stores all environment variables to target/,
    allowing secrets to persist in caches.
Then proceed to blame Github Actions.

All CI platform that provide caching and would naturally cache the build folder that is target/ would have this security hole. The culprit is cargo miri, not Github Actions.