# Huge Security issue with Environment Variables **URL:** \ **Category:** Build Environment\ **Tags:** 2.0, envars, security\ **Created:** [June 25, 2018, 5:44pm UTC](https://discuss.circleci.com/t/huge-security-issue-with-environment-variables/23175 "2018-06-25T17:44:37Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![pdeva](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/pdeva/32/30720_2.png) [@pdeva](https://discuss.circleci.com/u/pdeva)\ **Post date:** [June 25, 2018, 5:44pm UTC](https://discuss.circleci.com/t/huge-security-issue-with-environment-variables/23175/1 "2018-06-25T17:44:37Z")
The recommended CircleCI guidelines seem to be use environment variables for different environments. Eg: ```auto PROD_AWS_ACCESS_KEY_ID #for prod deployments DEV_AWS_ACCESS_KEY_ID #for dev deployments ``` However, there is no way to configure CircleCI to limit access to these variables at a branch level. Thus any developer with write access to our git repository can modify the `.circleci/config.yml` and use the `PROD_AWS_ACCESS_KEY_ID` env variable to deploy dev/other malicious code to the production environment. In fact, this can even happen by accident due to a dev potentially copy pasting some portion of the yaml code while editing. This seems like a huge security issue and I am surprised CircleCI has no real workarounds/features in progress to address this. ---
**Author:** ![halfer](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/halfer/32/9083_2.png) [@halfer](https://discuss.circleci.com/u/halfer)\ **Post date:** [June 25, 2018, 11:42pm UTC](https://discuss.circleci.com/t/huge-security-issue-with-environment-variables/23175/2 "2018-06-25T23:42:47Z")
It’d be interesting to see if any other CI providers have tackled what you perceive to be a security threat, but I would have thought that any dev that can write to your repo is already completely trusted. ---
**Author:** ![tadwhitaker](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/tadwhitaker/32/5024_2.png) [@tadwhitaker](https://discuss.circleci.com/u/tadwhitaker)\ **Post date:** [June 27, 2018, 11:13pm UTC](https://discuss.circleci.com/t/huge-security-issue-with-environment-variables/23175/3 "2018-06-27T23:13:15Z")
Thanks @pdeva for your diligence. This is not a security issue. In the future, we have a responsible disclosure process outlined at [https://circleci.com/security/](https://circleci.com/security/). If an administrator does not trust their developers to push to production, they should not put production keys in the environment of the builds. We are building new features that will help our users model deployment systems that live outside of their build/test workflows, but it is not a bug in our current system. For strict segregation between those who can write code and the keys to production systems, the administrator should not put keys in an environment in which the code is executed. In our current system this would mean: - Putting the deployment keys in a separate project that only specific users or administrators can access. - Maintaining a separate build configuration project that operates on the artifacts of your main CI builds. We will soon release a feature to CircleCI Contexts that will let an administrator restrict execution only to certain groups of people. This new feature will be useful for teams that need to model segregation of duties between those who write code and those who deploy. ---
**Author:** ![vhaberkorn](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/vhaberkorn/32/13076_2.png) [@vhaberkorn](https://discuss.circleci.com/u/vhaberkorn)\ **Post date:** [July 24, 2018, 7:34pm UTC](https://discuss.circleci.com/t/huge-security-issue-with-environment-variables/23175/4 "2018-07-24T19:34:45Z")
@tadwhitaker What is the expected release that for that feature? ---
**Author:** ![tadwhitaker](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/tadwhitaker/32/5024_2.png) [@tadwhitaker](https://discuss.circleci.com/u/tadwhitaker)\ **Post date:** [July 24, 2018, 8:42pm UTC](https://discuss.circleci.com/t/huge-security-issue-with-environment-variables/23175/5 "2018-07-24T20:42:29Z")
Hi @vhaberkorn, thanks for following up. I would say within a month or so. ---
**Author:** ![system](https://global.discourse-cdn.com/circleci/original/3X/5/1/511608acda8e85906e15909b57bd0a46c1dbe291.png) [@system](https://discuss.circleci.com/u/system)\ **Post date:** [October 22, 2018, 8:42pm UTC](https://discuss.circleci.com/t/huge-security-issue-with-environment-variables/23175/6 "2018-10-22T20:42:39Z")
This topic was automatically closed 90 days after the last reply. New replies are no longer allowed. ---
**Author:** ![tadwhitaker](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/tadwhitaker/32/5024_2.png) [@tadwhitaker](https://discuss.circleci.com/u/tadwhitaker)\ **Post date:** [June 19, 2019, 11:17pm UTC](https://discuss.circleci.com/t/huge-security-issue-with-environment-variables/23175/7 "2019-06-19T23:17:17Z")
Hi @pdeva. In addition to our statement above above, we rolled out Restricted Contexts a while ago to make access more granular. You can read about them here: [https://circleci.com/docs/2.0/contexts/#restricting-a-context](https://circleci.com/docs/2.0/contexts/#restricting-a-context)