Travis CI Security Breach Notice
Closed this issue · 1 comments
MolSSI is reaching out to every repository created from the MolSSI Cookiecutter-CMS with a .travis.yml file present to alert them to a potential security breach in using the Travis-CI service.
Between September 3 and September 10 2021, the Secure Environment Variables Travis-CI uses were leaked for ALL projects and injected into the publicly available runtime logs. See more details here. All Travis-CI users should cycle any secure variables/files, and associated objects as soon as possible. We are reaching out to our users in the name of good stewards of the third-party products we recommended and might still be in use and provide a duty-to-warn to our end-users given the potential severity of the breach.
We at MolSSI recommend moving away from Travis-CI to another CI provider as soon as possible. The nature of this breach and the way the response was mis-handled by Travis-CI, MolSSI cannot recommend the Travis-CI platform for any reason at this time. We suggest either GitHub Actions (as is used from v1.5 of the Cookiecutter-CMS) or some other service offered on GitHub.
If you have already addressed this security concern or it does not apply to you, feel free to close this issue.
This issue was created programmatically to reach as many potential end-users as possible. We do apologize if this was sent in error.
Thanks for the warning, Levi. I've audited this repo and:
- Ensured it had no repo-level secrets to leak (it didn't have any of these)
- Ensured it didn't have access to org-level secrets (it didn't have access before)
- Ensured it didn't have repo-level Travis integration permissions
- Narrowed down the org-level Travis integration permissions only repos that absolutely need it and don't expose secrets.
If we need to restart development of this repo in the future, we should ensure that we get CI running on GitHub Actions.