Are secured variables really secure?

남성식_ut81iy

I know that tje value of these variable are hidden on the pipeline‘s output.

But I could see those values with this trick below:

 

- step:

    script:

      - echo $VAR >> var.txt

    artifacts:

      - var.txt

You can see the value on var.txt file.

 

I want to use workspace variable for saving workspace access token, to reference it on a pipeline for accessing API, but because of this vulnerability I hesitate.

 

 

Theodora Boudale

Hi @남성식 and welcome to the community!

If you make a variable secured, its value will be masked in the build log. Pipelines masks all occurrences of a secure variable's value in your log files (the variable name will show instead), regardless of how that output was generated.

However, both workspace and repository variables can be retrieved by any user that has write access to the repo where the build is running.

You could use deployment variables instead and if your workspace is on the Premium plan, you can restrict deployments to admins only. This way, only users with admin access could use the script from your post to retrieve the deployment's variable value; users with write access only won't be able to do that.

You can check the following links for more details about deployment variables and deployment permissions:

• https://support.atlassian.com/bitbucket-cloud/docs/variables-and-secrets/#Deployment-variables
• https://bitbucket.org/blog/deployment-permissions-now-available-in-bitbucket-pipelines

Kind regards,
Theodora