Rust's Miri tool saved every environment variable into the `target/` folder, so a secret in a CI job could land in a GitHub Actions cache that pull requests can read.
You are exposed only if four things are true at once: you run `cargo miri`, secrets reach that step, `target/` is cached, and that cache is readable by pull requests.
The first Miri nightly with the fix is dated September 22, 2026, but old cache entries stay poisoned until you delete them and rotate the secrets.
A plain-text scan of a 236 MB `target/` folder took about 15 seconds in our test, and it can prove a leak but never prove a cache is clean.