CI Secret Exposed for 14 Months After Base64 Encoding Bypassed Log Masking

A software team discovered their container registry deploy token had been visible in CI build logs for fourteen months after an engineer spotted it during a failed build review. The leak occurred because the CI runner's masking system only redacts exact string matches — once the token was base64-encoded for a basic auth header and the shell ran in trace mode, the transformed value was logged unmasked. A second exposure came from the registry returning full request headers in an error response, which the team logged wholesale. To remediate, the team rotated the token, registered all derived secret values explicitly with the runner, banned shell tracing in credential-handling steps, and replaced the long-lived token with a short-lived OIDC credential expiring in 15 minutes. A follow-up automated log scan uncovered a second leaked secret in a separate repository tied to an unowned service.