The Claude Code GitHub Action leaked CI/CD secrets through /proc/self/environ until v2.1.128.

Microsoft's security team disclosed that before v2.1.128, a single malicious issue or comment could exfiltrate CI/CD secrets by reading unsanitized environment variables. Anthropic patched it. If you run the action on untrusted input, pin to >=2.1.128 right now, and adopt the harder default it implies: treat anything an agent can read in your CI environment as already compromised. Scope secrets, don't dump them into env, and assume the agent's context is hostile-readable.