CircleCI Security Incident – “Rotate any secrets stored in CircleCI”
3 comments
What a fine word "rotate" is in this case
I received this email as well. Here is the blog post:
https://circleci.com/blog/january-4-2023-security-alert/
More active thread on the issue:
https://news.ycombinator.com/item?id=34255319
https://news.ycombinator.com/item?id=34255319
https://circleci.com/blog/january-4-2023-security-alert/
--
We wanted to make you aware that we are currently investigating a security incident, and that our investigation is ongoing. We will provide you updates about this incident, and our response, as they become available. At this point, we are confident that there are no unauthorized actors active in our systems; however, out of an abundance of caution, we want to ensure that all customers take certain preventative measures to protect your data as well.
Action request:
Out of an abundance of caution, we strongly recommend that all customers take the following actions:
- Immediately rotate any and all secrets stored in CircleCI. These may be stored in project environment variables or in contexts.
- We also recommend customers review internal logs for their systems for any unauthorized access starting from December 21, 2022 through today, January 4, 2023, or upon completion of your secrets rotation.
Additionally, if your project uses Project API tokens, we have invalidated those and you will need to replace them. You can find more information on how to do that in our documentation here.
We apologize for any disruption to your work. We take the security of our systems and our customers’ systems extremely seriously. While we are actively investigating this incident, we are committed to sharing more details with customers in the coming days.
Thank you for your urgent attention to rotating your secrets.