Rotate any secrets stored in CircleCI

Re:Rotate any secrets stored in CircleCI by theogravity on Wednesday January 04, 2023 @10:43PM (#34255644)

Does this also include deploy SSH keys?

[ Parent | on HN ]

Re:Rotate any secrets stored in CircleCI by richbell on Wednesday January 04, 2023 @11:02PM (#34255785)

Given the wording of "any and all secrets" I would not take any chances.

[ Parent | on HN ]

Re:Rotate any secrets stored in CircleCI by chrisntb on Thursday January 05, 2023 @01:05AM (#34256642)

"Immediately rotate any and all secrets stored in CircleCI. These may be stored in project environment variables or in contexts."

The blog post calls out "environment variables" and "contexts"

[ Parent | on HN ]

Re:Rotate any secrets stored in CircleCI by richbell on Thursday January 05, 2023 @01:15AM (#34256694)

Emphasis on may be; not to mention, they are actively investigating the breach and do not have all the information at this time.

[ Parent | on HN ]

Re:Rotate any secrets stored in CircleCI by preetamjinka on Wednesday January 04, 2023 @11:01PM (#34255783)

Better to be cautious and rotate those too, right?

[ Parent | on HN ]

Re:Rotate any secrets stored in CircleCI by DylanL on Thursday January 05, 2023 @01:10AM (#34256667)

[ Parent | on HN ]

Re:Rotate any secrets stored in CircleCI by theogravity on Thursday January 05, 2023 @05:10PM (#34267578)

Thanks. Sigh, I have ~20 OSS repos with them that I'll need to generate new keys for then.

[ Parent | on HN ]

Re:Rotate any secrets stored in CircleCI by chrisntb on Thursday January 05, 2023 @07:20PM (#34269062)

We contacted CircleCI support and they clarified their blog post statement with the following info:

"Thank you for contacting CircleCI Support.

This does also apply to SSH Keys, as such we do recommend to rotate SSH Keys as well as to take extra caution.

If you have any other concerns please reach out."

[ Parent | on HN ]