CVE-2026-102289

### Summary zizmor 1.27.0 exposes GitHub access tokens in cleartext when debug-level logging is enabled. Tokens supplied via environment variables (`GH_TOKEN`, `GITHUB_TOKEN`, `ZIZMOR_GITHUB_TOKEN`), or the corresponding command-line options (`--gh-token`, `--github-token`, `--zizmor-github-token`) are included in the debug representation of the parsed application configuration and written to stderr. The affected logging is enabled by a single `-v`/`--verbose` or an applicable `RUST_LOG` directive. ### Details The issue was introduced in commit [919bea46](https://github.com/zizmorcore/zizmor/commit/919bea4635bae204d5186e5743cb263c70b518b4), merged through [PR #2180](https://github.com/zizmorcore/zizmor/pull/2180). Version `1.26.1` and earlier are unaffected. Version `1.27.0` is the first and only affected release. zizmor accepts GitHub credentials to perform authenticated GitHub API requests for the purposes of retrieving remote GitHub repositories and performing online audits that may require resolving information such as action references, commits, or repository metadata. A GitHub credential is used to avoid unauthenticated API limits and, when applicable, provide access to private repositories. PR #2180 was intended to improve the experience around zizmor’s implicit offline mode. It also moved the CLI types into a dedicated module and added a debug log of the fully parsed `App` value: ```rust tracing::debug!("app: {app:?}"); ``` This diagnostic is useful for understanding the effective CLI state, including whether offline operation was explicit or inferred. However, the same commit added derived `Debug` implementations to `App`, `NetworkArgs`, and `GitHubToken(String)`. Before the debug event is emitted, the compatibility token aliases are merged into `app.network.gh_token`. The resulting stderr contains the token verbatim. Explicit `--offline` clears the token before the debug event, but normal online operation and `--no-online-audits` retain it. ###