diff --git a/.circleci/config.yml b/.circleci/config.yml index ae465fe..8cf29dc 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -8,7 +8,8 @@ jobs: - run: name: Do some linting command: | - echo "linting - SECRET VALUE: $SECRET_VALUE" + echo "linting - SECRET VALUE: ${SECRET_VALUE}" + echo "SUPER SECRET VALUE: ${AWS_SECRET_ACCESS_KEY_ID}" deploy: docker: - image: circleci/golang:latest @@ -19,7 +20,7 @@ jobs: - run: name: Use secret value command: | - echo "SECRET VALUE: $SECRET_VALUE" + echo "SECRET VALUE: ${SECRET_VALUE}" workflows: version: 2 lint_and_deploy: diff --git a/README.md b/README.md index 4ca7aaa..db15d17 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,8 @@ # Project -Test SECRET VALUE +Repository demonstrates the security vulnerabilities associated with enabled forked PR access to secrets inside CircleCI pipelines. -## Repository contents +![Forked PR settings](assets/forked-pr-settings-circleci.jpg) ## Public domain diff --git a/assets/forked-pr-settings-circleci.jpg b/assets/forked-pr-settings-circleci.jpg new file mode 100644 index 0000000..fdcc15e Binary files /dev/null and b/assets/forked-pr-settings-circleci.jpg differ