Run logs of a public repository are public, and Gitea prints variables in them in clear text; only secrets are masked. They are now set only on the publish step, the one step that needs them. Claude-Session: https://claude.ai/code/session_01GGe7kUhooMFuzY6GaDb2w9