zizmor version 1.27.0 logs GitHub access tokens in cleartext to stderr when debug-level logging is enabled, exposing sensitive credentials. This occurs because debug logging prints the fully parsed application configuration, including tokens supplied via environment variables or command-line options. The vulnerability is fixed in version 1.28.0.