#What's Changed

[Feature] GitHub Actions joins Vercel, Supabase and Cloudflare as a sync target. Install ApiVault's GitHub App on the repositories you choose, link one to a project, and map each ApiVault environment to the repository's secrets or to a named deployment environment. Nothing is stored that could be replayed: ApiVault keeps only the installation id and mints a short-lived token for each run.
[Feature] A mapping row can name a deployment environment that does not exist yet, and ApiVault creates it in your repository under exactly the name you typed. The sync preview lists those creations in a group of their own, so you see each name before anything is created.
[Feature] GitHub reports when each secret last changed, so ApiVault can tell you a secret it manages was edited on GitHub. The vault still wins and the value is put back, but the change is reported rather than passing unnoticed.
[Improvement] A secret that was changed on GitHub and is no longer in the vault is left in place rather than deleted, and reported as left behind. Unlinking or disconnecting still removes everything ApiVault owns.
[Fix] A provider's error message is now withheld from the sync error if it quotes a secret value, not only verbatim but in an escaped or encoded spelling: a value containing a quote, a backslash or a newline could previously be echoed back in its escaped or URL-encoded form. This hardens Vercel, Supabase and Cloudflare as well as GitHub.