Wiz counted 13,500 Gheist branches today. I rebuilt its masking bypass in 15 lines and scanned my own repos.
The Gheist campaign plants a sync-check workflow with stolen GitHub tokens and prints repo secrets base32-encoded, defeating verbatim log masking. I verified the masking bypass locally, scanned my own 12 public repos / 26 branches (0 hits, all 9 workflow files clean), and tested a content-marker scanner: 3/3 variants flagged, 3/3 benign workflows clean.
🎯 Vulnerability: Web Security Vulnerability
💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.