[CircleCI Security Alert] Rotate any secrets stored in CircleCI

[yannCI]

@trevormarshall

Came here for this, thank you for posting. We have noticed the same and none of the tools we’ve found so far are looking for these.

In these cases you need to check for old env vars by crafting a url by hand:
https://app.circleci.com/settings/project/github/github-org/github-repo/environment-variables

Also:

• if a GitHub org has revoked 3rd-party access, the dashboard will be gone but the env vars might still linger.
• if a repo was archived

Perhaps Circle could comment on whether these settings that were kept (when they should have been discarded) were also compromised.

Cheers.

Hi @trevormarshall ,

When you hit the “Stop Building” in the CircleCI project, or archive/delete a repository in the VCS, the project build data and projects settings are indeed still present.

Though the build data:

• build history (pipelines you’ve run and their output)
• caches, workspaces, and artifacts

will age out automatically, based on your Organization plan and settings (See Data Retention Policy), the project settings will indeed remain, unless you manually remove them or send us an explicit request for the whole project to be deleted.

As long as the project still exist in CircleCI, you can access the “Project Settings” either by:

• Constructing the URL as you suggested (https://app.circleci.com/settings/project/<vcs>/<org_name>/<project_name>)

or

• Using the CircleCI v1 and v2 APIs

  • For SSH checkout keys > https://circleci.com/api/v2/project//<vcs>/<org_name>/<project_name>/checkout-key

  • For environment variables > https://circleci.com/api/v2/project/<vcs>/<org_name>/<project_name>/envvar

  • For the Jira integration and other legacy integrations > https://circleci.com/api/v1.1/project/<vcs>/<org_name>/<project_name>/settings