# Environment Variable not set if build triggered by someone who is not me

**URL:** <https://discuss.circleci.com/t/environment-variable-not-set-if-build-triggered-by-someone-who-is-not-me/33048>\
**Category:** Build Environment\
**Created:** [October 23, 2019, 6:38pm UTC](https://discuss.circleci.com/t/environment-variable-not-set-if-build-triggered-by-someone-who-is-not-me/33048 "2019-10-23T18:38:41Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ardunn](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/ardunn/32/23496_2.png) [@ardunn](https://discuss.circleci.com/u/ardunn)\
**Post date:** [October 23, 2019, 6:38pm UTC](https://discuss.circleci.com/t/environment-variable-not-set-if-build-triggered-by-someone-who-is-not-me/33048/1 "2019-10-23T18:38:41Z")

</div>

Hi there,

I have enabled a sensitive environment variable (lets call it MY\_ENV\_VAR) in My projects settings --\> Build --\> Environment variables.

I have a build, which I **triggered via push**. I ssh into the build and find that MY\_ENV\_VAR is being set. Great!

However, when **someone else** triggers the next build via PR, I notice it fails because the env var is not set. Rerunning and SSHing into the build I can confirm MY\_ENV\_VAR is NOT set.

In my `config.yml`, I do not set or edit MY\_ENV\_VAR. The only place where it is set is in the Build --\> Environment variables menu in the Circle web app.

**How can I enable this variable to be set for both builds triggered by me and by builds triggered by others?**

Thanks,  
Alex

---

<div class="post-metadata">

**Author:** ![gordon](https://avatars.discourse-cdn.com/v4/letter/g/3da27b/32.png) [@gordon](https://discuss.circleci.com/u/gordon)\
**Post date:** [October 24, 2019, 9:15am UTC](https://discuss.circleci.com/t/environment-variable-not-set-if-build-triggered-by-someone-who-is-not-me/33048/2 "2019-10-24T09:15:24Z")

</div>

Welcome Alex!

From what you’ve described I suspect that the other person is opening the PR from a fork of your repo.

There is a setting in the “Advanced Settings” page for your project called “Pass secrets to builds from forked pull requests” which will make those env-vars available to forks.

Have a good read of [https://circleci.com/docs/2.0/oss/#pass-secrets-to-builds-from-forked-pull-requests](https://circleci.com/docs/2.0/oss/#pass-secrets-to-builds-from-forked-pull-requests) and be sure you’ve considered the security implications before you turn that setting on.  
If it’s possible for untrusted people to open a fork PR against your repo then enabling this setting could leak sensitive data to a malicious fork.

If you have a private repo, and if you trust everybody with the ability to create a fork PR then this isn’t so much of a concern.

-Gordon

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/circleci/original/3X/5/1/511608acda8e85906e15909b57bd0a46c1dbe291.png) [@system](https://discuss.circleci.com/u/system)\
**Post date:** [November 3, 2019, 9:15am UTC](https://discuss.circleci.com/t/environment-variable-not-set-if-build-triggered-by-someone-who-is-not-me/33048/3 "2019-11-03T09:15:26Z")

</div>

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.