diff --git a/packages/core/src/utils/workspaceContext.test.ts b/packages/core/src/utils/workspaceContext.test.ts
index 1badf7a136d..ef1aa35df82 100644
--- a/packages/core/src/utils/workspaceContext.test.ts
+++ b/packages/core/src/utils/workspaceContext.test.ts
@@ -523,6 +523,21 @@ describe('WorkspaceContext with optional directories', () => {
       }
     });
 
+    it('should reject GitHub Actions Workload Identity credentials', () => {
+      const workspaceContext = new WorkspaceContext(cwd);
+
+      const sensitivePaths = [
+        path.join(cwd, 'gha-creds-12345.json'),
+        path.join(cwd, 'gha-creds-abcde.json'),
+        path.join(cwd, 'GHA-CREDS-abcde.JSON'), // Case-insensitivity check
+        path.join(cwd, 'subfolder', 'gha-creds-12345.json'), // Nested
+      ];
+
+      for (const p of sensitivePaths) {
+        expect(workspaceContext.isPathWithinWorkspace(p)).toBe(false);
+      }
+    });
+
     it('should allow standard non-sensitive paths', () => {
       const workspaceContext = new WorkspaceContext(cwd);
 
@@ -531,6 +546,8 @@ describe('WorkspaceContext with optional directories', () => {
         path.join(cwd, '.gitignore'),
         path.join(cwd, '.env.example'),
         path.join(cwd, 'package.json'),
+        path.join(cwd, 'tsconfig.json'),
+        path.join(cwd, 'gha-creds.json'), // Doesn't match the pattern
       ];
 
       for (const p of safePaths) {
diff --git a/packages/core/src/utils/workspaceContext.ts b/packages/core/src/utils/workspaceContext.ts
index 987cb40546b..ffb5e7a30cc 100755
--- a/packages/core/src/utils/workspaceContext.ts
+++ b/packages/core/src/utils/workspaceContext.ts
@@ -191,9 +191,18 @@ export class WorkspaceContext {
             const clean = trimTrailingSpacesAndDots(
               segment.split(':')[0],
             ).toLowerCase();
-            return (
-              clean === '.git' || clean === '.env' || clean === 'node_modules'
-            );
+            if (
+              clean === '.git' ||
+              clean === '.env' ||
+              clean === 'node_modules'
+            ) {
+              return true;
+            }
+            // Block GitHub Actions Workload Identity credentials
+            if (clean.startsWith('gha-creds-') && clean.endsWith('.json')) {
+              return true;
+            }
+            return false;
           });
           if (hasBlockedSegment) {
             return false;