GitLab CI/CD masked variable coverage for Base64-encoded job output
GitLab CI/CD variables marked as Masked are hidden from job logs through a string-replacement mechanism that targets the exact stored value. When a job script transforms that value—for example, piping a secret through base64 or embedding it in a JSON payload—the transformed representation no longer matches the original variable string and can appear in plain