GHSA-8qj9-f9q5-4v4r: 
Rust vulnerability analysis and mitigation

Kule masks the secrets a person keeps in the settings files a task's commands can read (the copy's .env files, and .zshrc, .profile, ~/.env and the like in the home layer). A kept secret was replaced only where it was the whole value of a KEY=value setting; inside a line (an alias, a longer value, a command, a comment, or URL/JSON-encoded) the agent could read it. Secrets kept for another folder were not masked in the home layer at all.

Fix

Every kept secret, for this folder or another, is masked wherever it is in those files. A commit or an apply puts a masked line back only where it is unchanged, and no more times than the file held it.

Workaround

Until the fixed release, keep secrets in those files only as a whole KEY=value setting.