CI secrets are readable from runner memory: the 2026 credential isolation architecture for GitHub Actions

CI secrets are readable from runner memory: the 2026 credential isolation architecture for GitHub Actions Summary. In March 2026, attackers compromised 75 of 76 trivy-action version tags by force-push