Skip to content

CircleCI Token

Service Name: CircleCI

Service Description: CircleCI is a continuous integration and continuous delivery platform that automates the build, test, and deployment processes for software development teams. It supports a wide range of languages and integrates with GitHub, Bitbucket, and other version control systems.

Service Address: https://circleci.com/

Validation Type: API Auth

IP Allow list: IP restrictions can be configured at the organization level through context restrictions and security settings.

Secret Access Scope: Grants access to build and deployment pipelines, repositories, and project configurations within CircleCI. Can be used to trigger builds, access project data, and manage workflows.

Secret Revokement URL: https://app.circleci.com/settings/user/tokens

Secret Example: CIRCLE_TOKEN_1a2b3c4d5e6f7g8h9i0j

Suspicious Activity Investigation Instructions:

  • Review the CircleCI dashboard for unauthorized builds or workflow executions.
  • Check project settings for any unauthorized changes to build configurations.
  • Examine audit logs for unusual access patterns or unauthorized API calls.
  • Verify repository access and permissions for any unexpected changes.
  • Monitor for unusual resource usage or unexpected deployments.

Mitigation Instructions:

  • Sign in to your CircleCI account.
  • Go to User Settings.
  • Go to the Personal API Tokens section.
  • Identify the compromised token and select Delete.
  • Create a new token with appropriate permissions if needed.
  • Update any CI/CD pipelines, scripts, or applications using the old token.
  • Review and update project security settings to implement context restrictions.
  • Consider implementing environment-specific contexts to limit token scope.
  • Enable notifications for important build events to monitor for suspicious activity.