Between the 3 Sept and 10 Sept, secure env vars of *all* public @travisci repositories were injected into PR builds. Signing keys, access creds, API tokens.
Anyone could exfiltrate these and gain lateral movement into 1000s of orgs. #security 1/4
travis-ci.community/t/security-bul…
Anyone could exfiltrate these and gain lateral movement into 1000s of orgs. #security 1/4
travis-ci.community/t/security-bul…
Felix Lange found this on the 7th and we've notified @travisci within the hour. Their only response being "Oops, please rotate the keys", ignoring that *all* their infra was leaking.
Not getting through, we've started reaching out to @github to have Travis blacklisted. 2/4
Not getting through, we've started reaching out to @github to have Travis blacklisted. 2/4
After 3 days of pressure from multiple projects, @travisci silently patched the issue on the 10th.
No analysis, no security report, no post mortem, not warning any of their users that their secrets might have been stolen. 3/4
No analysis, no security report, no post mortem, not warning any of their users that their secrets might have been stolen. 3/4
Finally after multiple ultimatums from multiple projects @travisci posted this lame ass post hidden deep where nobody will read it: travis-ci.community/t/security-bul…
Not even a single "thank you". Not acknowledgment of responsible disclosure. Not even admitting the gravity of it all. 4/4
Not even a single "thank you". Not acknowledgment of responsible disclosure. Not even admitting the gravity of it all. 4/4
Due to the extremely irresponsible way @travisci handled this situation, and their subsequent refusal to warn their users about potentially leaked secrets, we can only recommend everyone to immediately and indefinitely transfer away from Travis.
Just for posterity, here's their original announcement. I do hope they update it to something more meaningful. 
• • •
Missing some Tweet in this thread? You can try to
force a refresh
