Hands-On Continuous Integration and Delivery

Best practices for environment variable safe usage

It is important that you do not add secrets inside of the .circleci/config YML script file. If you do, you may leak secret information on the job log that may be publicly accessible. The full text of the config.yml is visible to developers with access to your project on CircleCI, so instead store your secrets and/or keys in Project or Context settings in the CircleCI app. Running scripts within configuration may expose secret environment variables so be careful when using the set -o xtrace / set -x in your run steps as they might expose environment variables.

One thing to note is that all environment variables are encrypted using Hashicorp Vault (https://www.vaultproject.io/) and environment ...