Gheist: 13,500 secret-dumping workflows planted with stolen GitHub tokens — audit yours in 5 minutes

Since September, a campaign called Gheist planted 13,500 secret-dumping workflows with stolen GitHub tokens — base32 defeats log masking, permissions:{} protects nothing, and the exfil channel is GitHub itself. The audit that tells you in 5 minutes if you were hit.