Uploaded image for project: 'MongoDB Database Tools'
  1. MongoDB Database Tools
  2. TOOLS-3711

Consider storing secrets in Evergreen private variables instead of public ones

    • Type: Icon: Task Task
    • Resolution: Unresolved
    • Priority: Icon: Minor - P4 Minor - P4
    • None
    • Affects Version/s: None
    • Component/s: None
    • 1
    • Tools and Replicator
    • 1

      This is an automatically generated Jira ticket. If you have any questions, please ask in #ask-devprod-evergreen. Also, feel free to redirect this if there's a more relevant team/Jira project to address this ticket.

      During an internal audit of Evergreen project variable usage, the Evergreen team detected that some Evergreen project(s) associated with this Jira project are potentially storing sensitive secrets in public project variables. It's generally recommended under Evergreen's best practices to store sensitive secrets as private variables instead of public variables. Changing these variables to be private instead of public may improve the security of your Evergreen project(s).

      If you'd like to change some or all of these variables to be private, please visit the relevant project settings page, check "Private" under the variables that you'd like to make private, and press "Save changes on page".

      This is only a recommendation and not a requirement. Feel free to close if you think the variables listed should stay public.

      The Evergreen projects and their associated public variables that were detected:

      Evergreen project: mongo-tools
      Variable names:

      • snyk_organization_id
      • iam_auth_assume_role_name

            Assignee:
            Unassigned Unassigned
            Reporter:
            kimberly.tao@mongodb.com Kim Tao
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated: