Re: [BUG] git-credential-libsecret writes secret to stdout on store

["Mantas Mikulėnas" <grawity@gmail.com>]

On 21/04/2026 14.03, Lutz-Christian Quander wrote:
> The documented pattern for seeding credentials non-interactively is:
>
>     printf "protocol=...\nhost=...\nusername=...\npassword=...\n\n" | 
> git-credential-<helper> store
>
> Running this at a terminal prints the secret into scrollback.
> Running it in a shell script whose stdout goes to a log file
> persists the secret in that log. Running it in CI captures the
> secret in the pipeline artefact. Every real-world use of the
> documented pattern is affected.
>
> Severity is moderate: the leak requires the user to run a legitimate
> command -- no attacker-controlled input path -- but the leak happens
> on the "correct" documented workflow, silently, with exit code 0.

Is it actually the correct documented workflow? I couldn't find it in 
the Git docs. My understanding was that writing to "git credential 
approve" was the sole user interface, while "git-credential-<helper> 
store" was the internal interface between the git-credential builtin and 
the helper.