CircleCI
More info
- Creator
- Paul Biggar, Allen Rohner
- Released
- 2011
- Type
- Cloud service
Hosted CI service from San Francisco that, one January morning in 2023, asked every customer to rotate every secret.
CircleCI launched in 2011 as one of the first alternatives to running your own Jenkins: connect the repo, drop a YAML file in .circleci/config.yml and let the service run the tests on every push. Reusable configuration packages are called orbs. Competition got tougher once GitHub Actions built the same thing straight into the code host.
In January 2023 the company disclosed that malware on an engineer's laptop had stolen a logged-in SSO session, and that the attacker had reached customers' environment variables, tokens and keys. The advice was to rotate all of them. It was a reminder that a CI/CD service ends up holding the keys to everything it builds and deploys.