GitHub uses a libsodium sealed box to help ensure that secrets are encrypted before they reach GitHub and remain encrypted until you use them in a workflow. For secrets stored at the organization-level, you can use access policies to control which repositories can use organization secrets.