# Secure circle.yml file **URL:** \ **Category:** Build Environment\ **Created:** [July 22, 2016, 6:28pm UTC](https://discuss.circleci.com/t/secure-circle-yml-file/5277 "2016-07-22T18:28:56Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![nvanheuverzwijn](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/nvanheuverzwijn/32/10744_2.png) [@nvanheuverzwijn](https://discuss.circleci.com/u/nvanheuverzwijn)\ **Post date:** [July 22, 2016, 6:28pm UTC](https://discuss.circleci.com/t/secure-circle-yml-file/5277/1 "2016-07-22T18:28:56Z")
Hi, Is there any we can secure the circle.yml file ? As of now, we would like to use circleci to auto deploy our build to the production servers. However, it seems that any developper can modify the circle.yml file (via a branch), build a malicious version and release that version to production. Thanks ---
**Author:** ![pburkholder](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/pburkholder/32/13555_2.png) [@pburkholder](https://discuss.circleci.com/u/pburkholder)\ **Post date:** [July 27, 2016, 2:38pm UTC](https://discuss.circleci.com/t/secure-circle-yml-file/5277/2 "2016-07-27T14:38:39Z")
If you set up deployments from ‘production’ branch, say, then you can enable GitHub branch permissions: [https://help.github.com/articles/about-branch-restrictions/](https://help.github.com/articles/about-branch-restrictions/) Presumably whoever has permissions to push to the production branch has reviewed the changes going into it. Does that help? ---
**Author:** ![psykeron](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/psykeron/32/13600_2.png) [@psykeron](https://discuss.circleci.com/u/psykeron)\ **Post date:** [July 30, 2016, 4:14pm UTC](https://discuss.circleci.com/t/secure-circle-yml-file/5277/3 "2016-07-30T16:14:03Z")
I am facing the same issue with security. Correct me if I’m wrong, protected branches still don’t protect deployments to production servers. The malicious user can configure circle.yml on their branch to deploy the branch version to the production server. This is possible because environment variables associated with securing the production servers are available to all branches being built. The only way to get around it seems to be with forks, but that takes away the flexibility of developing using branches. Is there any other solution to this? ---
**Author:** ![nvanheuverzwijn](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/nvanheuverzwijn/32/10744_2.png) [@nvanheuverzwijn](https://discuss.circleci.com/u/nvanheuverzwijn)\ **Post date:** [August 1, 2016, 2:27pm UTC](https://discuss.circleci.com/t/secure-circle-yml-file/5277/5 "2016-08-01T14:27:40Z")
Psykeron is right. What I would like to do is tell circleci to use the circle.yml file of, say the master branch. That way, I can protect master branch and I won’t have to worry about other branches that will modify the circle.yml. This seems like a reasonable feature to me. ---
**Author:** ![mfenniak](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/mfenniak/32/171_2.png) [@mfenniak](https://discuss.circleci.com/u/mfenniak)\ **Post date:** [August 1, 2016, 8:52pm UTC](https://discuss.circleci.com/t/secure-circle-yml-file/5277/6 "2016-08-01T20:52:02Z")
Another approach to this problem might be to expose the “project settings” environment variables only to builds that occur on a specific branch. This would be similar to how circle redacts the environment variables in fork builds. Combined with branch protection in GitHub (or another git-level access control mechanism, not related to circle), this seems like it would make things fairly secure. ---
**Author:** ![psykeron](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/psykeron/32/13600_2.png) [@psykeron](https://discuss.circleci.com/u/psykeron)\ **Post date:** [August 2, 2016, 2:45pm UTC](https://discuss.circleci.com/t/secure-circle-yml-file/5277/7 "2016-08-02T14:45:11Z")
The ability to have branch-specific environment variables would be a good solution to securing the parts of the circleci process. Global environment variables that can be accessed to keep the build process going for all the feature branches, and branch specific environment variables to protect the deployment sections. And if devs want to use insecure deploy servers, they can just bake their temp credentials into the feature branch’s circle.yml. ---
**Author:** ![nvanheuverzwijn](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/nvanheuverzwijn/32/10744_2.png) [@nvanheuverzwijn](https://discuss.circleci.com/u/nvanheuverzwijn)\ **Post date:** [August 2, 2016, 3:24pm UTC](https://discuss.circleci.com/t/secure-circle-yml-file/5277/8 "2016-08-02T15:24:02Z")
I’m not sure I get it. Where can you specify environment variable to specific branch ? Is it in the project settings of circleci ? I would really appreciate a practical example of this because right now, I don’t see how you can set an environment variable only to a specific branch. I also don’t get how this is more secure. You can always set an environment variable in a circle.yml (in the `machine` header). Thanks ---
**Author:** ![nvanheuverzwijn](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/nvanheuverzwijn/32/10744_2.png) [@nvanheuverzwijn](https://discuss.circleci.com/u/nvanheuverzwijn)\ **Post date:** [June 12, 2017, 10:01pm UTC](https://discuss.circleci.com/t/secure-circle-yml-file/5277/9 "2017-06-12T22:01:12Z")
Can anyone at circleci tell me how to secure the circle.yml ? There are simple feature request to solve this issue in the other comment. Actually, it is risky to use circleci for deployment when you’re in a big organization. Please, advise. ---
**Author:** ![jkillian](https://avatars.discourse-cdn.com/v4/letter/j/aeb1de/32.png) [@jkillian](https://discuss.circleci.com/u/jkillian)\ **Post date:** [July 18, 2017, 6:16pm UTC](https://discuss.circleci.com/t/secure-circle-yml-file/5277/10 "2017-07-18T18:16:59Z")
We’ve ran into this same [issue in TSLint development](https://github.com/palantir/tslint/issues/2985). We want to add collaborators to our open-source project, but we don’t want them to be able to publish releases or access our NPM-publishing credentials (currently stored as an env var in Circle). I believe something like a branch-specific env var might solve our issue as suggested by @psykeron, ---
**Author:** ![AvBrocklehurst](https://avatars.discourse-cdn.com/v4/letter/a/a88e57/32.png) [@AvBrocklehurst](https://discuss.circleci.com/u/AvBrocklehurst)\ **Post date:** [March 9, 2018, 3:13pm UTC](https://discuss.circleci.com/t/secure-circle-yml-file/5277/12 "2018-03-09T15:13:00Z")
We’re also running into difficulty here. You can build as much protection against accidentally deploying to production on circle ci, but you can hardly protect yourself from a malicious developer with write access to any branch. Has anything been done to address this? ---
**Author:** ![system](https://global.discourse-cdn.com/circleci/original/3X/5/1/511608acda8e85906e15909b57bd0a46c1dbe291.png) [@system](https://discuss.circleci.com/u/system)\ **Post date:** [June 18, 2018, 11:38am UTC](https://discuss.circleci.com/t/secure-circle-yml-file/5277/13 "2018-06-18T11:38:31Z")