CircleCI: Environment Variables Leaked on Open-Source Projects Allowing Pull Request Builds
Timeline of updates
- resolved
CircleCI engineers identified a bug late Friday afternoon affecting open-source projects that allow building pull requests. By default, the fork pull request builds got passed any environment variables the parent repo is configured with, despite claims in the project settings. An engineer patched the issue Friday for the SaaS product and released an Enterprise version Saturday. The issue affected a small subset of users, each of which was personally notified Saturday so project administrators had time to rotate credentials ahead of this public disclosure. If you didn't received an email, this disclosure does not affect you. You can also double check fork pull request behavior under the "Advanced Settings" section in projects. There is no evidence of lost data or known malicious behavior as a result of the issue.
From CircleCI’s published incident history: for incidents before Rewindex began polling this status page, only the final update text is available.
Archive proof
Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert.
How the archive is checked, and what it cannot prove.
This incident predates live tracking (October 17, 2026). It came from the vendor’s own published history, which is not covered by checkpoints.
Impact, status and times are the vendor’s own, as last archived. View on status.circleci.com (opens in new tab).
Cite this
Status incident (vendor impact label: none) posted by CircleCI, started 2017-06-05 22:01 UTC, resolved after 0 min, 1 update(s).
- Title
- Environment Variables Leaked on Open-Source Projects Allowing Pull Request Builds
- Vendor
- CircleCI
- Date
- URL
- https://rewindex.com/company/circleci/incidents/44kkj0g1ptdj
CircleCI profileRecent CircleCI incidentsAll outages on June 5, 2017CircleCI in June 2017MarkdownJSON