# \[CircleCI Security Alert\] Rotate any secrets stored in CircleCI

**URL:** <https://discuss.circleci.com/t/circleci-security-alert-rotate-any-secrets-stored-in-circleci/46479>\
**Category:** Security\
**Created:** [January 5, 2023, 2:50am UTC](https://discuss.circleci.com/t/circleci-security-alert-rotate-any-secrets-stored-in-circleci/46479 "2023-01-05T02:50:53Z")\
**Posts on this page:** 1\
**Showing post:** 172

<div class="post-metadata">

**Author:** ![anon](https://avatars.discourse-cdn.com/v4/letter/a/47e85d/32.png) [@anon](https://discuss.circleci.com/u/anon)\
**Post date:** [January 10, 2023, 6:08pm UTC](https://discuss.circleci.com/t/circleci-security-alert-rotate-any-secrets-stored-in-circleci/46479/172 "2023-01-10T18:08:34Z")

</div>

Hello.

Based on our testing, github repos formerly setup in circle, which are then deactivated (“stop building”), but then re-setup later _retain their environment variable values_. For any org that has been using circle for a long time, there are likely many compromised secrets contained “invisibly” in deactivated projects. In the case of shared or long-lived secrets, its quite possible that those secrets are still usable.

I think CircleCI needs to spell this out explicitly as I don’t think it’s been clear in the public statements to date.

Would it be possible for Support to produce a list of formerly-active projects within an account? (From the UI, it seems projects never setup or projects formerly setup are indistinguishable.)

Thanks for your efforts on this.

---

_[View the full topic](https://discuss.circleci.com/t/circleci-security-alert-rotate-any-secrets-stored-in-circleci/46479)._