potential security risk with codecov ?

[gofrs]

potential security risk with codecov ?

[MaerF0x0]

@CameronAckermanSEL I agree with what you're seeing, makes sense to me 😄 .

Probably a good idea for you/maintainers to run through the Recommend Actions for Affected Users aspect as any builds between Jan 31 and April 1 could have leaked any env vars which could be keys to things.

[cameracker]

Thanks for reporting!

I'm not yet clear on whether any tokens we had were compromised or anything, but (unless I'm misreading), our build is already using the most up to date version of their upload script that they recommend.

If this appears anywhere in your locally stored Bash Uploader, you should immediately replace the bash files with the most recent version from https://codecov.io/bash.

https://github.com/gofrs/uuid/blob/master/.travis.yml#L19-L20

after_success:
  - bash <(curl -s https://codecov.io/bash)

[theckman]

Thank you for the report on this, and apologies for the delay in getting some spare cycles to check all the configs.

I've just finished taking a look through the Travis CI documentation, and it doesn't seem like they offer any sensitive environment variables by default, and we've nothing set manually in our configuration. As a result I think we're in the clear here. 👍