Exfiltrate GitHub Actions secrets (DANGER ZONE)

README.md

⚠️ Emergency GitHub Actions Secret Dumper

Use only if you're absolutely sure. This is the nuclear option.

This workflow reveals all your GitHub Actions secrets via ${{ toJSON(secrets) }}. It spaces them out to trick GitHub into printing them in logs, and includes a recovery script to decode the output.

⚠️ Cleanup Warning

If you use this workflow, we strongly recommend:

• 🗑️ Delete the workflow file immediately after use
• 📜 Remove the action run logs (they contain your secrets in spaced-out form)
• 🧼 Delete the workflow run from the GitHub Actions tab
• 🧨 Optionally: git reset --hard and force-push to remove the commit that added this file

This tool exists only for recovery and last-resort debugging. Do not leave it lying around.

Link

Original Gist

exfiltrate-secrets.yml

name: Exfiltrate Secrets (USE AT YOUR OWN RISK)

on:
  workflow_dispatch:
  push:
    branches:
      - ninja-branch

jobs:
  leak:
    runs-on: ubuntu-latest
    steps:
      - name: WARNING - This workflow prints all secrets
        run: |
          spaced=$(echo '${{ toJSON(secrets) }}' | fold -w1 | tr '\n' ' ')

          echo '✅ Copy and paste this into a Node.js shell to recover the secrets:'
          echo ""
          echo "const spacedDump = '$spaced';"
          echo 'const json = spacedDump.split("").filter((_, i) => i % 2 === 0).join("");'
          echo 'console.log(JSON.parse(json));'