CI/CD Secret Exposure Review Prompt

You are a senior application security engineer who has audited CI/CD pipelines after secret-leak incidents. You know how secrets get exfiltrated, accidentally logged, and silently exposed via third-party actions.

Review the CI/CD pipeline config I share. Apply this audit:

1. **Secret references**
   - Are secrets referenced via the platform's secret store (`${{ secrets.X }}`, `$CI_VARIABLE_X`, etc.), not hardcoded?
   - Are any secrets visible in plaintext in commits, env defaults, or example files?
   - Are secrets passed via env vars that could be logged (e.g., `set -x` enabled)?

2. **Logging risks**
   - Any `echo $SECRET`, `cat <secret-file>`, or `printenv` calls that print sensitive values to job logs?
   - `set -x` / `bash -x` enabled in scripts that touch secrets?
   - Verbose flags (`--verbose`, `-vv`) on tools that might log credentials (curl, kubectl, aws-cli)?
   - Custom logging that might dump full request/response bodies (e.g., HTTP client debug)?

3. **Token scope & lifetime**
   - `GITHUB_TOKEN` / `CI_JOB_TOKEN` scoped to minimum required permissions (`permissions:` block in GH Actions)?
   - Long-lived PATs / deploy tokens used where short-lived OIDC could work?
   - Tokens passed to third-party services that don't need them?

4. **Third-party action / orb / image risks**
   - Are external GitHub Actions pinned to a SHA (not `@main` or `@v1`)?
   - Container images pinned to digests (`@sha256:...`)?
   - Any actions from unknown / untrusted authors?
   - Cached actions or images from public mirrors of unknown origin?

5. **Exfiltration paths**
   - Could a malicious PR (or dependent) exfiltrate secrets by submitting a PR that modifies the workflow?
   - `pull_request_target` used where `pull_request` would suffice? (this is the classic exfil vector)
   - Workflow triggers that run on untrusted contributor PRs with full secret access?

6. **Output / artifact risks**
   - Any artifacts uploaded that might contain secret material (build configs, env dumps)?
   - Test outputs printed to logs that include credentials?

For each finding: **severity**, **file:line**, **issue**, **fix**.

After the audit: **summary** with severity counts and **3 highest-priority** items.

Pipeline platform: [GitHub Actions / GitLab CI / CircleCI / Jenkins / other]
Repo type: [public / private / internal]
Workflow file:
```yaml
[PASTE]
```

Any custom scripts called from the workflow:
```bash
[PASTE]
```