# CircleCI: Environment Variables Leaked on Open-Source Projects Allowing Pull Request Builds

> CircleCI status incident “Environment Variables Leaked on Open-Source Projects Allowing Pull Request Builds” on 2017-06-05: impact none (vendor’s label), 0 min, 1 update(s). Archived by Rewindex.

Canonical: https://rewindex.com/company/circleci/incidents/44kkj0g1ptdj
Last updated: 2017-06-05T22:01:00Z

- Impact (vendor’s label): none
- Status: resolved
- Started: 2017-06-05 22:01 UTC · Resolved: 2017-06-05 22:01 UTC · Duration: 0 min
- Updates: 1
- [Vendor status page: https://status.circleci.com/incidents/44kkj0g1ptdj](https://status.circleci.com/incidents/44kkj0g1ptdj)
- [Company: CircleCI](https://rewindex.com/company/circleci.md)

## Timeline of updates

- **resolved** 2017-06-05 22:01 UTC: CircleCI engineers identified a bug late Friday afternoon affecting open-source projects that allow building pull requests. By default, the fork pull request builds got passed any environment variables the parent repo is configured with, despite claims in the project settings. An engineer patched the issue Friday for the SaaS product and released an Enterprise version Saturday. The issue affected a small subset of users, each of which was personally notified Saturday so project administrators had time to rotate credentials ahead of this public disclosure. If you didn't received an email, this disclosure does not affect you. You can also double check fork pull request behavior under the "Advanced Settings" section in projects. There is no evidence of lost data or known malicious behavior as a result of the issue.

_From the vendor’s published history: only the final update text is available for incidents before Rewindex began polling this page._

## Cite this

Status incident (vendor impact label: none) posted by CircleCI, started 2017-06-05 22:01 UTC, resolved after 0 min, 1 update(s).

- Canonical URL: https://rewindex.com/company/circleci/incidents/44kkj0g1ptdj
- Citation: CircleCI, “Environment Variables Leaked on Open-Source Projects Allowing Pull Request Builds” (2017-06-05 22:01 UTC). Archived by Rewindex: https://rewindex.com/company/circleci/incidents/44kkj0g1ptdj (CC BY 4.0).
- Markdown link: `[CircleCI: Environment Variables Leaked on Open-Source Projects Allowing Pull Request Builds (2017-06-05)](https://rewindex.com/company/circleci/incidents/44kkj0g1ptdj)`


---
Canonical: https://rewindex.com/company/circleci/incidents/44kkj0g1ptdj · Markdown: https://rewindex.com/company/circleci/incidents/44kkj0g1ptdj.md · JSON: https://rewindex.com/api/v1/companies/circleci/incidents/44kkj0g1ptdj · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-04T17:09:16.291Z