WORKING AS UNEXPECTED

Summary from the TLDR Web Dev newsletter

A security vulnerability in GitHub's branch protection feature allows for protected credential exfiltration. This occurs when a wildcard branch protection rule is used, as it immediately protects any newly created branches, making them eligible to access secrets restricted to protected branches. This can be exploited to exfiltrate sensitive information, such as signing keys, by creating a new branch and setting up a workflow to access the secret.