Can we check if this affects us? Codecov Bash Uploader Security Problem about external-secrets HOT 3 CLOSED

I think we shouldn't be affected when looking at the pipeline:

      - name: Publish Unit Test Coverage
        uses: codecov/codecov-action@v1
        with:
          flags: unittests
          file: ./cover.out

From the blog post:

• (1) Any credentials, tokens, or keys that our customers were passing through their CI runner that would be accessible when the Bash Uploader script was executed.
• (1b) Any services, datastores, and application code that could be accessed with these credentials, tokens, or keys.
• (2) The git remote information of repositories using the Bash Uploaders to upload coverage to Codecov in CI.

We don't pass any secret/environment variables into it, so 1 and 1b does not apply, 2 is public information anyway.

Rotating credentials regularly isn't a bad idea anyway ;)

from external-secrets.

@riccardomc got an email about our original CS solution, and I am rotating our secrets there. Not sure why we were not affected here.

from external-secrets.

Rotating regularly is for sure a great idea! Gonna close this issue then :)

from external-secrets.