2 ms·
> How do I know what environment variables of mine may have been available to the actor? Collapse > You can determine the keys and tokens that are surfaced to
by koolba 6y ago
> How do I know what environment variables of mine may have been available to the actor? Collapse
> You can determine the keys and tokens that are surfaced to your CI environment by running the env command in your CI pipeline. If anything returned from that command is considered private or sensitive, we strongly recommend invalidating the credential and generating a new one. Additionally, we would recommend that you audit the use of these tokens in your system.
Be aware that the output will be sent to your CI output logs. If those logs are public (e.g. a FOSS project) then they will be publicly published and expose all your environment secrets.
- tyingq 6y ago> How do I know what environment variables of mine may have been available to the actor? Isn't that a tiny portion of what you would have to worry about? They seem too confident that they know exactly what unintended code was in the bash uploader script for the entire duration. Is there something about the setup that gives them that confidence?
- mhils 6y agoMost (all?) major CI providers automatically censor secrets printed in the worker log, so this is not as much of a concern. :)