drop gitea action log · runs locally
flags secrets in environment · docker socket mount · git credential helpers · failed deploy steps · non-zero exit codes
heuristic screener · act-runner log redaction varies · workflow/job/image detection is indicative only · not definitive proof