# How to protect environment variable from being echo or printed

**URL:** <https://discuss.circleci.com/t/how-to-protect-environment-variable-from-being-echo-or-printed/17219>\
**Category:** Build Environment\
**Tags:** circle-yml, cci-20\
**Created:** [October 8, 2017, 1:15pm UTC](https://discuss.circleci.com/t/how-to-protect-environment-variable-from-being-echo-or-printed/17219 "2017-10-08T13:15:23Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![beast](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/beast/32/8679_2.png) [@beast](https://discuss.circleci.com/u/beast)\
**Post date:** [October 8, 2017, 1:15pm UTC](https://discuss.circleci.com/t/how-to-protect-environment-variable-from-being-echo-or-printed/17219/1 "2017-10-08T13:15:23Z")

</div>

For example, if I follow the instruction on [CircleCI for Google Cloud Container Engine](https://circleci.com/docs/2.0/google-container-engine/). The env var will contain my service account credential that can do almost everything on my GCP project. If I echo this env var, the build output will print my secrets out. Even know I could turn on protection such as only pull request could build. This still leave me with the danger that if I didn’t catch the echo statement making into my circle.yml, I could have an insider that could get my secrets. Is there anyway to have a secret env var or workarounds? Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/circleci/original/3X/5/1/511608acda8e85906e15909b57bd0a46c1dbe291.png) [@system](https://discuss.circleci.com/u/system)\
**Post date:** [June 18, 2018, 11:39am UTC](https://discuss.circleci.com/t/how-to-protect-environment-variable-from-being-echo-or-printed/17219/2 "2018-06-18T11:39:59Z")

</div>