[CircleCI Security Alert] Rotate any secrets stored in CircleCI

zhudson · January 5, 2023, 7:50pm

UPDATE: We have created a tool for discovering all your secrets on CircleCI.

The difference between this and the BASH script originally posted is that this will support both repositories that are under an individual user’s GitHub account, and repositories that are under a GitHub organization. As mentioned earlier, the BASH script version only works for repositories listed under a given GitHub org.

Original response

We have created the following gist as a guide to output a list of projects and contexts that currently contain env vars, and a link to the “Environment Variables” section of each of these projects, and a link to each context retrieved.

gist.github.com

https://gist.github.com/yaningo/f3c62fda479467a50c43789ea736cff5

README.txt

To run the script locally:

1. Set an environment variable named `GH_TOKEN` populated with your [GitHub access token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token)
2. Set an environment variable named `CIRCLECI_API_TOKEN` populated with your [CircleCI personal API token](https://circleci.com/docs/managing-api-tokens/#creating-a-personal-api-token)
3. Set an environment variable named `ORG_NAME` populated with your organization name

env-var-grabber.sh

#!/bin/bash

#### Get a list of the organization's project
PROJECT_SLUGS=$(curl -s -G "https://api.github.com/orgs/$ORG_NAME/repos?per_page=100" -H "Authorization: bearer $GH_TOKEN" | jq -r '.[].full_name')

#### For each of these project, determine if there are nevenvironment variables
for PROJECT in $PROJECT_SLUGS
  do
    curl -s -G "https://circleci.com/api/v2/project/gh/$PROJECT/envvar" -H "circle-token: $CIRCLECI_API_TOKEN" > /tmp/env_vars.json
      if [ $(jq '.items|length' /tmp/env_vars.json) -gt 0 ]; then

This file has been truncated. show original

This was created by one of my colleagues on the support team - we are also in the process of creating another script that will be a bit more native, but we are offering this as a preliminary option for your teams to use.

Please be aware this method only works for GitHub users as this time

Topic		Replies	Views
[FAQ Compilation] Security Alert - Rotate any secrets stored in CircleCI Security	2	4293	January 5, 2023
Incident Report: January 4th, 2023 Security Incident Security	1	1169	January 13, 2023
Deployment is broken after rotating secrets Deployments rails , circle-yml	3	985	January 12, 2023
Automate Your API Key Rotation Using the Contexts REST API Announcements contexts	3	1836	October 26, 2021
Seeking CircleCI users for secrets management feedback Product Feedback	5	1389	February 9, 2022

[CircleCI Security Alert] Rotate any secrets stored in CircleCI

UPDATE: We have created a tool for discovering all your secrets on CircleCI.

Related topics