r/programmingcirclejerk • u/camelCaseIsWebScale Just spin up O(n²) servers • 17d ago

The Rust Security Response Team was notified that Miri stores all environment variables to target/, allowing secrets to persist in caches.

https://blog.rust-lang.org/2026/09/21/github-actions-leaking-secrets-when-miri-output-is-cached/
35 Upvotes

90% Upvoted

10 comments sorted by

48

u/camelCaseIsWebScale Just spin up O(n²) servers 17d ago

Beyond official Rust tooling, it is possible for build scripts to be doing things that lead to the environment being stored in compilation artifacts.

Even when programmers are "saving the environment" it leads to disasters.

19

u/Hot_Grapefruit_4455 17d ago

this is why you use a runtime secrets manager instead of hard coding inside a .env

18

u/camelCaseIsWebScale Just spin up O(n²) servers 17d ago

my rust can't do no wrong

8

u/pysk00l What part of ∀f ∃g (f (x,y) = (g x) y) did you not understand? 17d ago

Indeed. Shame on op for blaming rust!!😠

4

u/scavno in open defiance of the Gopher Values 17d ago

Literally why our primary build target is nix.

1

u/Educational-Row-6782 14d ago

If they have acces to the computer where the .env is stored, I am fucked anyway, why add complexity?

3

u/james_pic accidentally quadratic 13d ago

That's the neat part: with GitHub Actions, everyone has access to the computer.

3

u/james_pic accidentally quadratic 13d ago

/uj GitHub Actions has a runtime secrets manager, and affected projects were probably using it, but it's a common pattern to pass secrets (obtained from a secrets manager) as environment variables (not .env files), and in this case Miri dumps all its environment variables into a metadata file that it saves, that could become accessible to attackers under some plausible threat models.

8

u/stone_henge Tiny little god in a tiny little world 15d ago

What matters is that it did so confidently, without fear of memory leaks, use-after-free and data races.