Bitbucket: Show value of variables marked as secret

Question

For one of my repos I need to see the value I set to a secure property of a deployment (created as described in https://support.atlassian.com/bitbucket-cloud/docs/variables-and-secrets/#Secured-variables). Is there any way of retrieving the value stored there?

Since all its occurrences are masked (https://support.atlassian.com/bitbucket-cloud/docs/variables-and-secrets/#Secured-variable-masking), I had the idea of writing a value, I suspect I saved there, using "echo". If I see it being replaced in the logs by the variable, I know it's the secret value of that variable - but this would expose it to the history of my project.

Any further ideas?

Diaphysis

Answer 1

Security disclaimer: be responsible and after using this solution

• rotate the exposed secret in the affected systems
• delete pipeline logs

---

You can always modify the secret in a reversible way and echo it so that bitbucket does not find an exact match to mask in the logs. Splitting the value in chunks, interleaving the characters with whitespace or encoding the value with base64 or your favorite/available reversible string function.

E.g.

echo $SECRET | base64

copy&paste to your terminal and do

echo aXRzYXNlY3JldHRvZXZlcnlib2R5Cg== | base64 -d

Hawkeyed

Easy and effective, thanks! – Diaphysis