Key Info
A developer working on OpenCode argues that GitHub org-level and repo-level secrets cannot be truly secured, because any team member with write access who is compromised can exfiltrate those secrets.
Highlights
- Org-level and repo-level secrets are exposed to anyone on the team with write access
- A single hacked teammate account is enough to exfiltrate the secrets
- The recommended alternative is GitHub environments with protection rules, storing secrets there
- Framed as a practical security warning for teams relying on default secret scopes