Saint LeakyCLI, the Terminal That Talked Too Much

Patron of pipeline logs, plaintext environment variables, and behaviour that is "working as designed".

Life

In 2023 Orca Security reported that some Azure CLI commands printed secrets and credentials into logs, and those logs often ended up visible in public builds, for instance on GitHub Actions. Microsoft fixed it as CVE-2023-36052. On 16 April 2024 Orca showed that the AWS and Google Cloud CLIs did the same, but both vendors replied that this was expected behaviour and updated their documentation.

Prayer

O Saint LeakyCLI, who recites aloud what should stay unspoken, let our terminals learn to keep a secret. Amen.

How to celebrate

Celebrated by updating the Azure CLI, silencing output in pipelines, and searching old logs for things that should not be there.

A chatty shell keeps no secrets well.