UPDATE: 13-Jan-2022 21:22 UTC Today we published incident report for our security incident disclosed on January 4 on our blog here: [image] CircleCI incident report for January 4, 2023 security incident Read the complete incident report from CircleCI’s January 4, 2023 security alert. …

Today we published incident report for our security incident disclosed on January 4 on our blog here: [image] CircleCI incident report for January 4, 2023 security incident Read the complete incident report from CircleCI’s January 4, 2023 security alert.

So, are we safe rotating all the environment variables? How do we know that this is not still open/vulnerable? To be honest, the information provided about the issue is really poor.

We need to rotate the personal tokens too?

Thank you, this was very helpful. I used it to extend to Legacy AWS Configuration too, since those keys are still dangerous but not exposed in the UI or new API (which is a very silly thing, in my opinion): const getProjectSettings = async ( projectName: string, pageToken?: string ): Promise<a…

With Jira integration, each project has a token generated by a CircleCI plugin in Jira and then added to each project’s settings page via the Jira section. Do we need to rotate this secret? How do we rotate this secret in the CircleCI plugin in Jira? The secret appears to be hardcoded and I can’t …

@z00b , Would it be possible to confirm if “Deploy Keys” are on the list of things that need to be rotated I know a few others have asked but it would be great to get a clear list of elements that need to be rotated as part of this advisory (With where to find them on projects and if possible scri…

For those working with circleCI and GitHub, here is a script we did today QuickStart python main.py list-ctx python main.py list-env python main.py list-keys python main.py replace-keys with the following main.py file import requests import argparse from config import API_TOKEN, GH_TOKEN, ORG # C…

Hello CircleCI! Do you have any script already done, or a docker image, that lists all the secrets that could have been compromised? We have lots of repositories, so we need a tool to dump everything we have configured, rotate credentials and then run again to be sure everything was rotated. I se…

For the various teams at CircleCI, working day & night on this - Thank you! It was not an easy decision to go public without having all the details, even though this now means additional pressure to work the case faster # YouDidTheRightThing.

When does CircleCI plan to notify customers by email?

[CircleCI Security Alert] Rotate any secrets stored in CircleCI

Announcements Security

tarh33l January 5, 2023, 5:01pm 33

The lack of engagement by CircleCI staff on this thread is concerning, to say the least

Topic		Replies	Views
[FAQ Compilation] Security Alert - Rotate any secrets stored in CircleCI Security	1	4395	January 5, 2023
Rotating all of the Organizations Deploy keys Tips, Tricks, and Hacks api	1	1410	October 31, 2022
Deployment is broken after rotating secrets Deployments rails , circle-yml	3	1032	January 12, 2023
Generate a new API token Build Environment api	1	1751	June 15, 2017
Debug with SSH has stopped working in BitBucket Feedback & Bug Reports	55	6999	April 8, 2019

[CircleCI Security Alert] Rotate any secrets stored in CircleCI

Related topics