For teams expressing agent behavior as GitHub Actions, secret flow across steps is a concrete safety boundary rather than a generic scanner rule. The project remains pre-1.0 and lacks independent production evidence.
Next stepWithin one day, pass a test credential through two step outputs and verify compile-time blocking, runtime redaction and safe-output exceptions against policy.