6 ms·
Does this also include deploy SSH keys?
by theogravity 4y ago
Does this also include deploy SSH keys?
- preetamjinka 4y agoBetter to be cautious and rotate those too, right?
- richbell 4y agoGiven the wording of "any and all secrets" I would not take any chances.
- chrisntb 4y ago"Immediately rotate any and all secrets stored in CircleCI. These may be stored in project environment variables or in contexts." The blog post calls out "environment variables" and "contexts"
- richbell 4y agoEmphasis on may be; not to mention, they are actively investigating the breach and do not have all the information at this time.
- DylanL 4y agoLooks like yes: https://discuss.circleci.com/t/circleci-security-alert-rotate-any-secrets-stored-in-circleci/46479/8 https://discuss.circleci.com/t/circleci-security-alert-rotat...
- theogravity 4y agoThanks. Sigh, I have ~20 OSS repos with them that I'll need to generate new keys for then.
- chrisntb 4y agoWe contacted CircleCI support and they clarified their blog post statement with the following info: "Thank you for contacting CircleCI Support. This does also apply to SSH Keys, as such we do recommend to rotate SSH Keys as well as to take extra caution. If you have any other concerns please reach out."