bitbucket-upload-file App password security practices

[Samantha Finnigan]

I'm looking at bitbucket-upload-file as a potential solution to send Pipelines build results to the Downloads section of my repository.

To do this, it looks like I need to commit a BITBUCKET_APP_PASSWORD variable directly into the repository within the `bitbucket-pipelines.yml` file.

The app password would by necessity have permission to read and write to my repositories, and in using this solution, that password would be published to my (public) repository.

That seems like a Really Bad Idea. Perhaps I'm missing something? Maybe there are better password security practices which I could follow in the deployment of my built code?

[ktomk · Accepted solution]

@Samantha Finnigan Indeed, only use variables in the pipelines by their identifier/name and *set* them in the project settings, the second half of: https://support.atlassian.com/bitbucket-cloud/docs/variables-in-pipelines/

[Samantha Finnigan]

That's exactly what I was looking for, thanks :)