Log Scrubbing - CI/CD Glossary Definition
Log scrubbing filters sensitive or noisy data out of CI logs before they are stored or forwarded.
Log scrubbing is the practice of filtering CI log output to remove secrets, PII, or noise, whether via the runner's built-in masking or a downstream pipeline that sanitizes logs before shipping them to an aggregator.
Defense in depth
Rely on runner masking as the first layer, but scrub again where logs leave GitHub (log forwarders, incident tooling). Never echo a secret to test masking: if masking misses the transform, the value leaks permanently.
Related guides
Secret Masking - CI/CD Glossary DefinitionSecret Masking: Secret masking is the runner behavior that scans log output for registered secret values and…
Encrypted Secret - CI/CD Glossary DefinitionEncrypted Secret: An encrypted secret is a credential GitHub encrypts (using libsodium sealed boxes on upload…
Build Log - CI/CD Glossary DefinitionBuild Log: A build log is the recorded stdout and stderr of every step in a job. It is the primary evidence f…