Leaked secrets in action logs

All substrings in action logs that match any of the secret variables are hidden with 3 asterisks (***).
I have a secret variable “ac” defined. As you can see in the screenshot, any substring “ac” in the logs is escaped with asterisks. For example, it’s easy to guess what’s hidden under the asterisks in a line.


Gitea version: 1.21.10 built with GNU Make 4.4.1, go1.21.8 : bindata, timetzdata, sqlite, sqlite_unlock_notify
Deployed from docker image gitea/gitea:1.21.10