Preventing leakage of sensitive information — quick notes
Preventing leakage — quick notes
| Fact | Detail |
|---|---|
| Log masking | Transformed or encoded values are not masked automatically; register the derived value before output, and prior occurrences remain exposed |
| Secret variables in scripts | Must be explicitly mapped via env: |
| Command-line arguments | Avoid — they can appear in process listings and logs |
| Public GitHub fork validations | Secrets and protected resources are not exposed by default |
| Nonsecret variable-group values | Masking is not guaranteed; access is not limited by approvals, checks, or pipeline permissions |
| Git history | Revoke or rotate first; removing the current file does not remove the secret from history, clones, or forks |
Strongest control: remove the stored credential. WIF exchanges a trusted external token for an access token; managed identities let suitable Azure-hosted workloads obtain tokens without developer-managed credentials.
Primary sources: https://learn.microsoft.com/en-us/azure/devops/pipelines/process/variables?view=azure-devops · https://learn.microsoft.com/en-us/azure/devops/pipelines/scripts/logging-commands?view=azure-devops · https://learn.microsoft.com/en-us/azure/devops/pipelines/library/variable-groups · https://learn.microsoft.com/en-us/azure/devops/pipelines/security/overview?view=azure-devops · https://learn.microsoft.com/en-us/entra/workload-id/workload-identity-federation · https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview · https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository