← Back to all fixes
CI/CD

Secret accidentally printed in CI logs

The Issue

Running a build command printed `DB_PASSWORD=mysecret` in the CI log that is visible to all team members.

Root Cause

The command echoed env vars (e.g. `set -x` in shell scripts, verbose build tools), or the secret was passed as a CLI argument rather than an env var.

How to Fix
  1. Rotate the exposed secret immediately — treat it as compromised
  2. Remove `set -x` from shell scripts that run in CI
  3. Pass secrets as environment variables, never as CLI arguments
  4. Use your CI system's secret masking — most platforms auto-mask registered secrets in logs
  5. Audit your scripts: `grep -r "echo.*SECRET" .` to find accidental prints
← More fixes