# Environment Variables are insecure and transferred to new repository owners

**URL:** <https://travis-ci.community/t/environment-variables-are-insecure-and-transferred-to-new-repository-owners/11589>\
**Category:** Deployment\
**Tags:** github-integration, travis-build, bug\
**Created:** [May 13, 2021, 6:18am UTC](https://travis-ci.community/t/environment-variables-are-insecure-and-transferred-to-new-repository-owners/11589 "2021-05-13T06:18:28Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![SolarUltima](https://sea1.discourse-cdn.com/flex015/user_avatar/travis-ci.community/solarultima/32/4019_2.png) [@SolarUltima](https://travis-ci.community/u/SolarUltima)\
**Post date:** [May 13, 2021, 6:18am UTC](https://travis-ci.community/t/environment-variables-are-insecure-and-transferred-to-new-repository-owners/11589/1 "2021-05-13T06:18:28Z")

</div>

I used a github to transfer the repository to the new owner. We test a build and watched it deploy. The Travis CI console showed a successful deploy. The problem is, it deployed to _my_ AWS account using _my_ AWS credentials. The environment variables had been transferred to a third party and were no longer in my control, any fix?

---

<div class="post-metadata">

**Author:** ![Montana](https://sea1.discourse-cdn.com/flex015/user_avatar/travis-ci.community/montana/32/9566_2.png) [@Montana](https://travis-ci.community/u/Montana)\
**Post date:** [May 13, 2021, 6:26am UTC](https://travis-ci.community/t/environment-variables-are-insecure-and-transferred-to-new-repository-owners/11589/2 "2021-05-13T06:26:29Z")

</div>

The threat model/paradigm in this particular situation isn’t really an _attacker_ (if an attacker gets into your GitHub account, it’s essentially all over anyway).

The main issue at hand is regarding the `secrets`. The trivial fix is to wipe secure `env vars` _then_ change hands. Seems like the most logical and safe thing to do, and unfortunately in this case this _didn’t_ happen.

I’d recommend setting the value from the Travis CLI just to rule everything out `travis env set GH_TOKEN <your token>`.

If you want to be secret about _that_ token even in your terminal:

```bash
read -s NEW_TRAVIS_PASS <enter your password in the empty void> 
cd <directory containing the cloned repo> travis env set 
GH_TOKEN $NEW_TRAVIS_PASS unset NEW_TRAVIS_PASS

```

I’ve seen a similar case, where people don’t clear their `env vars` before transferring over repositories to new owners. This is the equivalent of wiping a phone before giving it to a new owner, etc. For good measure you can delete the logs with the `--delete` flag, which optionally takes a reason as an argument:

```bash
travis logs --delete DANGER ZONE: Do you really want to delete the build log for travis-
ci/travis.rb#559.1? |no| yes deleting log for travis-ci/travis.rb#559.1 $ travis logs 1.7 --delete "contained c
onfidential data" --force deleting log for travis-ci/travis.rb#1.7

```

Another way of doing this is using the Travis API via:

```bash
curl -X DELETE \
  -H "Travis-API-Version: 3" \
  -H "Authorization: token xxxxxxxxxxxx" \
  https://api.travis-ci.com/job/{job.id}/log

```

In turn:

```bash
DELETE
/job/{job.id}/log

```

Make sure on their end it’s encrypted again, should look like this:

 ![image](https://us1.discourse-cdn.com/flex015/uploads/travis_ci/original/2X/d/da60c4065017b4596f3ea7289be9cdb8f8c474d4.png)  
Travis CI uses a public-key/private-key security system, also known as [asymmetric cryptography](https://en.wikipedia.org/wiki/Public-key_cryptography), to encode and decode sensitive data. When I encrypt `env vars` in Travis, under the covers, the Travis CLI tool used the public key to do the encryption.

However, decryption can only take place within the Travis CI runtime environment, because only Travis CI has access to the private key.

These are all things you must remember when dealing with `env vars` and are _completely_ relevant to the Travis CI `env vars`. It’s no different than Docker. I hope this helps and hopefully this gets you out of hot water, and lesson learned.

Montana Mendy  
Travis CI Staff

---

<div class="post-metadata">

**Author:** ![native-api](https://sea1.discourse-cdn.com/flex015/user_avatar/travis-ci.community/native-api/32/430_2.png) [@native-api](https://travis-ci.community/u/native-api)\
**Post date:** [May 13, 2021, 4:28pm UTC](https://travis-ci.community/t/environment-variables-are-insecure-and-transferred-to-new-repository-owners/11589/3 "2021-05-13T16:28:57Z")

</div>

If your AWS credentials got compromised (let’s be real),  
you need to change them, or revoke them if it’s an access token.

---

<div class="post-metadata">

**Author:** ![Montana](https://sea1.discourse-cdn.com/flex015/user_avatar/travis-ci.community/montana/32/9566_2.png) [@Montana](https://travis-ci.community/u/Montana)\
**Post date:** [May 13, 2021, 5:20pm UTC](https://travis-ci.community/t/environment-variables-are-insecure-and-transferred-to-new-repository-owners/11589/4 "2021-05-13T17:20:51Z")

</div>

@native-api,

To say the least. As I stated it’s unfortunate that the `env vars` were not wiped when the transfer occurred.

---

<div class="post-metadata">

**Author:** ![SolarUltima](https://sea1.discourse-cdn.com/flex015/user_avatar/travis-ci.community/solarultima/32/4019_2.png) [@SolarUltima](https://travis-ci.community/u/SolarUltima)\
**Post date:** [May 13, 2021, 10:49pm UTC](https://travis-ci.community/t/environment-variables-are-insecure-and-transferred-to-new-repository-owners/11589/5 "2021-05-13T22:49:07Z")

</div>

yeah we sorted out problem this morning, thank you for all the help

---

<div class="post-metadata">

**Author:** ![Montana](https://sea1.discourse-cdn.com/flex015/user_avatar/travis-ci.community/montana/32/9566_2.png) [@Montana](https://travis-ci.community/u/Montana)\
**Post date:** [May 14, 2021, 9:53am UTC](https://travis-ci.community/t/environment-variables-are-insecure-and-transferred-to-new-repository-owners/11589/6 "2021-05-14T09:53:01Z")

</div>

I’m curious as how you got this sorted out? - Was it something technical, or a human variable?