GitHub Actions leaking secrets when Miri output is cached

Summary

The Rust Security Response Team reported that Miri writes all environment variables to the target/ directory, so secrets can persist in caches and be exposed to pull requests through GitHub Actions caching.

Key facts

• Miri stores all environment variables to target/, per the Rust Security Response Team.
• Secrets can persist in caches and be exposed to PRs via GitHub Actions caching.
• The team said this is not necessarily a vulnerability on its own.
• The Rust Blog post is dated 2026-09-21.

Why it matters

Builds that run Miri under GitHub Actions caching may leak environment secrets into pull requests, so teams should treat cached Miri output as sensitive and review their CI caching setup.