Rust Security Response advises checking CI setups that cache Miri output alongside secrets
Miri saved all environment variables into target/, which could expose secrets through shared GitHub Actions caches.
The Rust Security Response Team reported that cargo miri stored every environment variable in the target directory. If a CI workflow caches that directory and also exposes secrets to the step that runs Miri, the secrets can end up in the cache.
On GitHub Actions the cache is often readable by pull request runs. Someone who has previously landed a change could trigger a run that reads the cached files. The team notes this is not a vulnerability by itself, but the combination is risky.
The short-term fix makes Miri keep only the Cargo-related variables it needs. The team scanned GitHub repositories, found one with the problem and seven that looked safe but should be careful, and contacted those maintainers.
Projects that run Miri in CI should check whether the job has secrets and a shared cache. Quick fixes include disabling the cache for that job or scoping secrets to steps that do not run Miri. Clear the existing cache afterwards and consider rotating any secrets that may have been exposed.