Vendor
zizmor version 1.27.0 exposes GitHub access tokens in cleartext within stderr when debug-level logging is enabled, risking credential theft through shared CI logs or bug reports.