drop github actions self-hosted runner log · parse job execution + secret reference · runs locally
flags secret echo attempts · unexpected registry login · runner label mismatch · cleanup failures · masked values stay opaque
masked secret values are opaque — reference patterns only · heuristic screener · indicative only · not definitive proof