DX010: Secret printed in workflow logs

Severity: high · Category: security · Applies to: github_actions

Why it matters

Echoing a secret writes it to the build log, where encoding tricks defeat masking.

How to fix

Pass the secret through an environment variable and never echo it.

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - DX010

Or skip one line with a comment on that line or the line above:

devshield-ignore: DX010