What is a common mistake when working with GitHub Actions secrets?

A common mistake with GitHub Actions secrets is placing secrets in logs, artifacts, command output, or workflows that run untrusted contributions can leak credentials even though the value is stored in the secrets feature. The safer approach is to design and test the behavior explicitly rather than assuming the platform or dependency will handle it automatically.