UPDATE: 13-Jan-2022 21:22 UTC Today we published incident report for our security incident disclosed on January 4 on our blog here: [image] CircleCI incident report for January 4, 2023 security incident Read the complete incident report from CircleCI’s January 4, 2023 security alert. …

Today we published incident report for our security incident disclosed on January 4 on our blog here: [image] CircleCI incident report for January 4, 2023 security incident Read the complete incident report from CircleCI’s January 4, 2023 security alert.

Does this also affect the BitBucket integration key?

And what about the source code itself?

Immediately rotate any and all secrets stored in CircleCI. These may be stored in project environment variables or in contexts. Does this mean the secret stored in “Project Settings > Environment Variables” in CircleCI? [image]

@t-asaeda Yes - as well as in “Organization Settings / Contexts” (if your company uses contexts).

Is it safe to add new secrets in CircleCI?

[image] dwrusse: The announcement only mentions secrets in contexts and environment variables, but what about SSH keys, Jira and Slack integration tokens, webhook secrets, etc? Yes. At this time we recommend rotating SSH Keys and all tokens or secrets.

How does CircleCI encrypt secrets in it’s backend? Was it a single encryption key the was “leaked”? What actions were taken to ensure environment integrity was restored?

[image] matiskay: Is it safe to add new secrets in CircleCI? Yes. At this point, we are confident that there are no unauthorized actors active in our systems. Thanks for your vigilance in keeping systems safe.

If you are looking for audit logs from CircleCI, you can request them from settings. Documentation on this feature is here: Audit logs - CircleCI We also advise you check the logs of any systems which had secrets stored in CircleCI.

Have you rotated the OIDC signing keys for orgs? [image] Using OpenID Connect Tokens in Jobs - CircleCI Learn how to use OpenID Connect ID tokens for access to compatible cloud services.

[CircleCI Security Alert] Rotate any secrets stored in CircleCI

Announcements Security

z00b January 5, 2023, 5:42am 8

Yes. At this time we recommend rotating SSH Keys and all tokens or secrets.

Topic		Replies	Views
[FAQ Compilation] Security Alert - Rotate any secrets stored in CircleCI Security	1	4351	January 5, 2023
Rotating all of the Organizations Deploy keys Tips, Tricks, and Hacks api	1	1387	October 31, 2022
Deployment is broken after rotating secrets Deployments rails , circle-yml	3	1027	January 12, 2023
Generate a new API token Build Environment api	1	1741	June 15, 2017
Debug with SSH has stopped working in BitBucket Feedback & Bug Reports	55	6976	April 8, 2019

[CircleCI Security Alert] Rotate any secrets stored in CircleCI

Related topics