A workflow log redacts an API token, but a later script encodes that token and prints the encoded value. Why is this still a security problem?

1. A redacted earlier step makes the entire subsequent job log private to the workflow author.
2. Only the literal secrets context can contain sensitive data.
3. Encoding permanently revokes the original token.
4. Avoid logging credential transformations and mask any derived sensitive values when needed.