{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/github-actions-cache-sensitive-data-fork-access/", "item": { "id": "https://update.dsesecurity.com/updates/github-actions-cache-sensitive-data-fork-access/", "slug": "github-actions-cache-sensitive-data-fork-access", "url": "https://update.dsesecurity.com/updates/github-actions-cache-sensitive-data-fork-access/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/github-actions-cache-sensitive-data-fork-access.md", "json": "https://update.dsesecurity.com/api/v1/posts/github-actions-cache-sensitive-data-fork-access/" }, "title": "Exclude credentials from GitHub Actions dependency caches accessible to pull requests", "summary": "A dependency cache is a shared workflow optimization and needs a reviewed content boundary.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "physical-security", "label": "Physical security", "alt": "Integrated video surveillance and controlled entry at a modern commercial facility.", "card_url": "https://update.dsesecurity.com/assets/editorial/physical-security-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/physical-security-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:14:23+00:00", "modified_at": "2026-10-20T18:34:30+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 277, "potentially_affected": "This concerns the Actions dependency-cache workflow and its access restrictions. Cache-key naming does not establish a secret-store access model or make sensitive cached files safe to disclose.", "dse_recommendation": "DSE recommends reviewing every cached path and its generated contents before enabling caching.", "primary_source": { "name": "GitHub — Dependency caching reference", "url": "https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching", "published_on": null, "authority": "docs.github.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

A dependency cache is a shared workflow optimization and needs a reviewed content boundary.

\n

Source facts

\n

GitHub warns against storing access tokens, login credentials or other sensitive information in cache paths. People with read access can create pull requests that access cache contents, and fork pull requests can access caches on the base branch. GitHub also states that existing cache contents cannot be changed in place; a new cache requires a new key.

\n

Source: GitHub — Dependency caching reference.

\n

Applicability

\n

This concerns the Actions dependency-cache workflow and its access restrictions. Cache-key naming does not establish a secret-store access model or make sensitive cached files safe to disclose.

\n

DSE recommendation

\n

DSE recommends reviewing every cached path and its generated contents before enabling caching. Keep package downloads separate from credential configuration and build outputs that might contain secrets. Review broad restore-key fallbacks alongside the intended trust boundary. Assign an owner to invalidate or retire unsuitable caches when the build layout changes, and investigate any suspected credential inclusion through the incident process rather than merely choosing a new key. Ask a reviewer to inspect generated files under every cache path, including tool-specific configuration directories. Give cache retirement an explicit owner and treat a suspected exposed credential as a revocation decision, rather than considering a changed cache key sufficient incident containment.

\n

Verification

\n

Proposed verification: in an approved repository, inspect a cache built from harmless test data and confirm only intended dependency files are included. Exercise the supported pull-request access path using a safe sample. Verify credential files are excluded and inspect logs for accidental values before rolling the cache configuration into a privileged workflow.

\n

Official reference

\n

GitHub — Dependency caching reference. Reviewed October 20, 2026.

", "content_text": "A dependency cache is a shared workflow optimization and needs a reviewed content boundary.\nSource facts\nGitHub warns against storing access tokens, login credentials or other sensitive information in cache paths. People with read access can create pull requests that access cache contents, and fork pull requests can access caches on the base branch. GitHub also states that existing cache contents cannot be changed in place; a new cache requires a new key.\nSource: GitHub — Dependency caching reference.\nApplicability\nThis concerns the Actions dependency-cache workflow and its access restrictions. Cache-key naming does not establish a secret-store access model or make sensitive cached files safe to disclose.\nDSE recommendation\nDSE recommends reviewing every cached path and its generated contents before enabling caching. Keep package downloads separate from credential configuration and build outputs that might contain secrets. Review broad restore-key fallbacks alongside the intended trust boundary. Assign an owner to invalidate or retire unsuitable caches when the build layout changes, and investigate any suspected credential inclusion through the incident process rather than merely choosing a new key. Ask a reviewer to inspect generated files under every cache path, including tool-specific configuration directories. Give cache retirement an explicit owner and treat a suspected exposed credential as a revocation decision, rather than considering a changed cache key sufficient incident containment.\nVerification\nProposed verification: in an approved repository, inspect a cache built from harmless test data and confirm only intended dependency files are included. Exercise the supported pull-request access path using a safe sample. Verify credential files are excluded and inspect logs for accidental values before rolling the cache configuration into a privileged workflow.\nOfficial reference\nGitHub — Dependency caching reference. Reviewed October 20, 2026.", "content_markdown": "A dependency cache is a shared workflow optimization and needs a reviewed content boundary.\n\n## Source facts\n\nGitHub warns against storing access tokens, login credentials or other sensitive information in cache paths. People with read access can create pull requests that access cache contents, and fork pull requests can access caches on the base branch. GitHub also states that existing cache contents cannot be changed in place; a new cache requires a new key.\n\nSource: [GitHub — Dependency caching reference](https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching).\n\n## Applicability\n\nThis concerns the Actions dependency-cache workflow and its access restrictions. Cache-key naming does not establish a secret-store access model or make sensitive cached files safe to disclose.\n\n## DSE recommendation\n\nDSE recommends reviewing every cached path and its generated contents before enabling caching. Keep package downloads separate from credential configuration and build outputs that might contain secrets. Review broad restore-key fallbacks alongside the intended trust boundary. Assign an owner to invalidate or retire unsuitable caches when the build layout changes, and investigate any suspected credential inclusion through the incident process rather than merely choosing a new key. Ask a reviewer to inspect generated files under every cache path, including tool-specific configuration directories. Give cache retirement an explicit owner and treat a suspected exposed credential as a revocation decision, rather than considering a changed cache key sufficient incident containment.\n\n## Verification\n\nProposed verification: in an approved repository, inspect a cache built from harmless test data and confirm only intended dependency files are included. Exercise the supported pull-request access path using a safe sample. Verify credential files are excluded and inspect logs for accidental values before rolling the cache configuration into a privileged workflow.\n\n## Official reference\n\n[GitHub — Dependency caching reference](https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/github-actions-cache-sensitive-data-fork-access/", "url": "https://update.dsesecurity.com/updates/github-actions-cache-sensitive-data-fork-access/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/github-actions-cache-sensitive-data-fork-access/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Exclude credentials from GitHub Actions dependency caches accessible to pull requests", "item": "https://update.dsesecurity.com/updates/github-actions-cache-sensitive-data-fork-access/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/github-actions-cache-sensitive-data-fork-access/#article", "identifier": "https://update.dsesecurity.com/updates/github-actions-cache-sensitive-data-fork-access/", "url": "https://update.dsesecurity.com/updates/github-actions-cache-sensitive-data-fork-access/", "headline": "Exclude credentials from GitHub Actions dependency caches accessible to pull requests", "description": "A dependency cache is a shared workflow optimization and needs a reviewed content boundary.", "abstract": "A dependency cache is a shared workflow optimization and needs a reviewed content boundary.", "articleBody": "A dependency cache is a shared workflow optimization and needs a reviewed content boundary.\nSource facts\nGitHub warns against storing access tokens, login credentials or other sensitive information in cache paths. People with read access can create pull requests that access cache contents, and fork pull requests can access caches on the base branch. GitHub also states that existing cache contents cannot be changed in place; a new cache requires a new key.\nSource: GitHub — Dependency caching reference.\nApplicability\nThis concerns the Actions dependency-cache workflow and its access restrictions. Cache-key naming does not establish a secret-store access model or make sensitive cached files safe to disclose.\nDSE recommendation\nDSE recommends reviewing every cached path and its generated contents before enabling caching. Keep package downloads separate from credential configuration and build outputs that might contain secrets. Review broad restore-key fallbacks alongside the intended trust boundary. Assign an owner to invalidate or retire unsuitable caches when the build layout changes, and investigate any suspected credential inclusion through the incident process rather than merely choosing a new key. Ask a reviewer to inspect generated files under every cache path, including tool-specific configuration directories. Give cache retirement an explicit owner and treat a suspected exposed credential as a revocation decision, rather than considering a changed cache key sufficient incident containment.\nVerification\nProposed verification: in an approved repository, inspect a cache built from harmless test data and confirm only intended dependency files are included. Exercise the supported pull-request access path using a safe sample. Verify credential files are excluded and inspect logs for accidental values before rolling the cache configuration into a privileged workflow.\nOfficial reference\nGitHub — Dependency caching reference. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:14:23+00:00", "dateModified": "2026-10-20T18:34:30+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/github-actions-cache-sensitive-data-fork-access/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/github-actions-cache-sensitive-data-fork-access/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Exclude credentials from GitHub Actions dependency caches accessible to pull requests" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 277, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "GitHub — Dependency caching reference", "url": "https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching" } } ] } }