Environment variables exposed when printed to log

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_134
Category	Credential Hygiene
Severity	LOW

Impact

Environment variables are widely used in CI/CD systems as a common method of sharing secrets between processes. They may contain credentials, internal host addresses, and additional sensitive information. Once environment variables are printed to the pipeline job log, an attacker with access to the log can exfiltrate these secrets, reaching sensitive resources.

Recommended Solution - Buildtime

Avoid running the env or printenv commands in the pipeline, which print the values of all environment variables including secrets, to the pipeline job logs.

Instead, print only required variables, verifying that no sensitive information is included.