I pointed my own security tool at my own GitHub Action. It found two bugs.

Description and use

Internal testing of SecHelix uncovered two bugs in its GitHub Action: uploading an unredacted artifact and forging output values. Fixes involve reading the redacted copy before upload and sanitizing output to prevent forging.

Problem

A security tool’s GitHub Action uploaded unredacted data and allowed output forging, exposing secrets and bypassing gate checks.

Outcome

The Action now uploads only redacted data and prevents output forging, reducing false positives and protecting secrets.

Workflow

• 1. Run audit: sechelix audit "$PATH" --json > sechelix-run.json
• 2. Upload artifact: actions/upload-artifact@... with path: sechelix-run.json
• 3. Identify bug: raw JSON contained secrets.
• 4. Fix upload: use sechelix report --format json to read persisted, redacted copy.
• 5. Detect output forging: review GITHUB_OUTPUT handling.
• 6. Fix forging: sanitize newline characters and enforce single key per output.
• 7. Add regression tests to confirm fixes.

Evidence

So the Action was uploading the unredacted projection into a build artifact that anyone with read access to the repository can download

Source

The fix is one line: re-read the persisted copy with sechelix report --format json before uploading anything.

Source

A value containing a newline writes a second key… When a key appears twice, the runner takes the last one.

Source