GHEIST PRINTS YOUR CI SECRETS INTO YOUR OWN LOG AND DELETES THE EVIDENCE
Gheist planted more than 13,500 branches across 850-plus compromised GitHub accounts to print CI secrets into workflow logs, then pulled them back through the GitHub API. The approval hold that stopped it covers public repos only, and that boundary is the story.