drop woodpecker ci log · runs locally
flags secrets in environment · registry login · kubectl/aws apply after credential mount · non-zero exit codes
heuristic screener · log redaction varies by runner · phase detection is indicative only · not definitive proof