# Security Bulletin

**URL:** https://travis-ci.community/t/security-bulletin/12081
**Category:** Announcements
**Created:** [September 13, 2021, 8:36pm UTC](https://travis-ci.community/t/security-bulletin/12081 "2021-09-13T20:36:49Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![Montana](https://sea1.discourse-cdn.com/flex015/user_avatar/travis-ci.community/montana/32/9566_2.png) [@Montana](https://travis-ci.community/u/Montana)
#### Post date: [September 13, 2021, 8:36pm UTC](https://travis-ci.community/t/security-bulletin/12081/1 "2021-09-13T20:36:49Z")

</div>

Hey all,

According to a received report, a Public repository forked from another one could file a pull request (standard functionality e.g. in GitHub, BitBucket, Assembla) and while doing it, obtain unauthorized access to secret from the original Public repository with a condition of printing some of the files during the build process. \*\*In this scenario secrets are still encrypted in the Travis CI database.

_The issue is valid only for **public** repositories not Private repositories. (In case of Private repository, Repository Owner has a full control on ability of someone to fork the repository. )_

_Travis CI implemented a series of security patches starting on Sept 3rd that resolves this issue._

_As a reminder, cycling your secrets is something that all users should do on a regular basis. If you are unsure how to do this please contact Support._

**Does this bulletin effect me:**

- **This Security Bulletin does NOT affect any Private Repositories**

- **This Security Bulletin does NOT affect any Public Repositories that were NOT forked**

- If you have a Public Repository that was forked, then there was a possibility that someone from the forked (copied) project might have been able to have seen the original project’s Secret ONLY for a short time while doing a build.

- The Secret would not have the potential of being seen outside of a build process running given it is encrypted when not in use.

- Our competitors design and operate similarly with Public Repositories given industry standard 3rd party usage.

- We updated our servers on Sept 3rd to resolve this potential issue.

- To date, we found no evidence of unauthorized parties leveraging the potential exposure.

- We continue to recommend that both Public and Private Repository customers rotate their secrets on a regular basis.

**For more information on GitHub secrets rotation please visit the following links:**

- To create or rotate a token [https://github.com/settings/tokens](https://github.com/settings/tokens)

- Use travis gem [https://github.com/travis-ci/travis.rb](https://github.com/travis-ci/travis.rb) to encrypt the secret for the repo ([https://github.com/travis-ci/travis.rb#encrypt](https://github.com/travis-ci/travis.rb#encrypt))

- Visit repo settings on [Travis CI - Test and Deploy with Confidence](https://app.travis-ci.com/github/qasimabdullah404/travis-slack-notifications-test/settings) and create environment variable

- GitHub docs on refreshing token ([Refreshing user-to-server access tokens - GitHub Docs](https://docs.github.com/en/developers/apps/building-github-apps/refreshing-user-to-server-access-tokens))

_Travis CI Team._