[theogravity]

Does this also include deploy SSH keys?

[DylanL]

Looks like yes: https://discuss.circleci.com/t/circleci-security-alert-rotat...

[theogravity]

Thanks. Sigh, I have ~20 OSS repos with them that I'll need to generate new keys for then.

[richbell]

Given the wording of "any and all secrets" I would not take any chances.

[chrisntb]

"Immediately rotate any and all secrets stored in CircleCI. These may be stored in project environment variables or in contexts."

The blog post calls out "environment variables" and "contexts"

[richbell]

Emphasis on may be; not to mention, they are actively investigating the breach and do not have all the information at this time.

[chrisntb]

We contacted CircleCI support and they clarified their blog post statement with the following info:

"Thank you for contacting CircleCI Support.

This does also apply to SSH Keys, as such we do recommend to rotate SSH Keys as well as to take extra caution.

If you have any other concerns please reach out."

[preetamjinka]

Better to be cautious and rotate those too, right?