# Encrypt API keys for open source projects?

**URL:** <https://travis-ci.community/t/encrypt-api-keys-for-open-source-projects/7577>\
**Category:** Travis CI Discussions & Feedback\
**Tags:** build-env\
**Created:** [March 14, 2020, 12:15pm UTC](https://travis-ci.community/t/encrypt-api-keys-for-open-source-projects/7577 "2020-03-14T12:15:06Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![montao](https://sea1.discourse-cdn.com/flex015/user_avatar/travis-ci.community/montao/32/4031_2.png) [@montao](https://travis-ci.community/u/montao)\
**Post date:** [March 14, 2020, 12:15pm UTC](https://travis-ci.community/t/encrypt-api-keys-for-open-source-projects/7577/1 "2020-03-14T12:15:06Z")

</div>

Now my API keys are encrypted with AES256 and get decrypted in the code pipeline for a new release for every change to the repo.

But if my project were open source then what will prevent an incoming PR which triggers the code pipeline to print the decrypted files in clear text?

If I assume that the project is open source and we did encrypt the API keys. Then an incoming PR could still trigger the Travis pipeline and could output the keys in clear text like this

```auto
- openssl aes-256-cbc -K $encrypted_42b9fd1_key -iv $encrypted_42b9fd1_iv -in secrets.tar.enc -out secrets.tar -d
- tar xvf secrets.tar
- cat api-key.json

```

How to prevent such a scenario ? or did I misunderstand ?

---

<div class="post-metadata">

**Author:** ![native-api](https://sea1.discourse-cdn.com/flex015/user_avatar/travis-ci.community/native-api/32/430_2.png) [@native-api](https://travis-ci.community/u/native-api)\
**Post date:** [March 14, 2020, 4:59pm UTC](https://travis-ci.community/t/encrypt-api-keys-for-open-source-projects/7577/2 "2020-03-14T16:59:04Z")

</div>

> [@montao](#):
>
> what will prevent an incoming PR which triggers the code pipeline to print the decrypted files in clear text?

Nothing. That’s why you can place keys into encrypted variables (in [either `.travis.yml`](https://docs.travis-ci.com/user/environment-variables/#defining-encrypted-variables-in-travisyml) or [Travis settings](https://docs.travis-ci.com/user/environment-variables/#defining-variables-in-repository-settings)) which are not accessible to PR builds.

---

<div class="post-metadata">

**Author:** ![BanzaiMan](https://sea1.discourse-cdn.com/flex015/user_avatar/travis-ci.community/banzaiman/32/67_2.png) [@BanzaiMan](https://travis-ci.community/u/BanzaiMan)\
**Post date:** [March 14, 2020, 10:18pm UTC](https://travis-ci.community/t/encrypt-api-keys-for-open-source-projects/7577/3 "2020-03-14T22:18:00Z")

</div>

Please read

> **[Travis CI Documentation](https://docs.travis-ci.com/user/pull-requests#pull-requests-and-security-restrictions)**
>
> Building Pull Requests