An environment-scoped secret is a sensitive value-such as a token, API key, or deployment credential-made available only to automation jobs targeting a named environment, such as staging or production. Access may also require reviewers to approve a deployment. This limits which workflows can use the secret and adds a control before it is exposed to a job.
In CI/CD systems, environment-scoped secrets help reduce the impact of compromised or malicious automation, but they are not a guarantee of safety. A workflow authorized to deploy to that environment may be able to access its secrets. Defenders should restrict who can change workflows and environment rules, require approvals for sensitive environments, review job permissions and execution logs, and rotate credentials if a job may have exposed them.