zizmor: Debug logging prints available GitHub credentials in cleartext
zizmor 1.27.0 exposes GitHub access tokens in cleartext when debug-level logging is enabled. Tokens supplied via environment variables (GH_TOKEN, GITHUB_TOKEN, ZIZMOR_GITHUB_TOKEN), or the corresponding command-line options (–gh-token, –github-token, –zizmor-github-token) are included in the debug representation of the parsed application configuration and written to stderr. The affected logging is enabled by a single -v/–verbose or an applicable RUST_LOG directive.