How to view the values of secured Repository variables?

[Rishabh Srivastava]

Below is the path of the variable that I'm trying to view:

Repository settings (on left vertical menu) -> Pipelines (submenu) -> Repository variables

Here it contains few secured variables whose values we are trying to fetch, any suggestions/help is appreciated.

[Ben · Accepted solution]

Hey Rishabh,

Unfortunately - you cannot view these values once they have been set - and these are obscured from the build log if you try to echo these. This is by design as secure variables are stored as encrypted values. If you want to edit a secure variable, you can only give it a new value or delete it.

More information regarding this can be found here:
https://support.atlassian.com/bitbucket-cloud/docs/variables-and-secrets/

Cheers!

- Ben (Bitbucket Cloud Support)

[Rishabh Srivastava]

Thanks Ben! :)

[남성식]

I tried below and it worked.

- step:

    script:

      - echo $VAR >> var.txt

    artifacts:

      - var.txt

You can see the value on var.txt file.

I‘m curious that secure variables are really secure. It could be exported to a file and this file could be downloaded!

[Ben]

Hey ,

I've just tested on my end with a secured variable - the value of the variable is not actually printed, it prints the variable name without the value - do you see the same output?

 - step:

   script:

   - echo $testvar >> var.txt

   - cat var.txt

[남성식]

Oh, you cannot see the value with 'cat', because the bitbucket automatically erase every string, which is same with secured variable.

So you should save it as a artifacts and download it to see the value.

[Ben]

Hey 남성식,

You're right actually, I've just tested this on my end.

I've raised a bug ticket - thank you for that, that's a great find:
https://jira.atlassian.com/browse/BCLOUD-22556

Cheers!

- Ben (Bitbucket Cloud Support)

[남성식]

Hey Ben,

As I think, this is the answer for your question: https://community.atlassian.com/t5/Bitbucket-questions/Are-secured-variables-really-secure/qaq-p/2306410#M91721

I was also wondering why these secured variables are viewable to developers, but these developers have already right to read and write this repository.

If you have other tokens, which has more right that just writing and reading the repo, then you should use deployment variable to save it and make that deployment environment to be restricted for admins only. Then developers can not trigger deployment step, so they couldn't download the artifacts which they generated with the script above.

btw. my name is pronounced Sungsik Nam. I'm pretty sure it was a bit(!) hard to pronounce.