Secret environment variables may leak in GitPod workspace logs when embedded in larger strings

Direct Answer

GitPod’s masking logic operates on the exact byte sequence of a secret’s value. When a secret is printed verbatim—whether as a standalone line or embedded in a larger string like echo \"Token=$GITPOD_TEST_TOKEN\"—the terminal output will replace that contiguous value with a mask (typically ***). The mask is applied only to terminal streams; other output channels are not guaranteed to be scrubbed.

Why Some Leaks Still Occur

• Transformation defeats masking: base64‑encoding, URL‑encoding, hashing, or splitting the value across arguments/lines prevents the scrubber from matching the raw secret.
• Non‑terminal destinations: IDE output panels, files written by scripts, container logs, or external API error bodies are outside the mask’s scope.
• Prebuilds: User secrets are typically omitted from prebuild images, so a stale value from a cached prebuild is unlikely. However, artifacts generated during a prebuild (e.g., a built Docker image) could carry derived values that survive into later workspaces.
• Secret status: If the variable isn’t marked as a secret in the workspace settings, GitPod will not mask it.

Secret Updates and Workspace Lifecycle

When you change a secret in the GitPod dashboard, the new value is injected into any workspace that starts after the change. Workspaces that are already running keep the old value until they are restarted. This is standard environment‑variable injection behavior and is not specific to any prebuild or task log.

Verification Checklist

1. Set a test secret in the workspace settings.
2. Print it in three ways:

   echo "$MY_SECRET"
   echo "Token=$MY_SECRET"
   echo "Base64: $(echo -n "$MY_SECRET" | base64)"
   

3. Observe the terminal output: the first two should be masked; the base64 line will not be masked because the value is transformed.
4. Run the same commands inside a task script and check the task log view—masking applies to the terminal stream but may not scrub the file.
5. Start a new workspace after changing the secret and confirm the new value appears masked.
6. If a secret ever shows up unmasked, verify that:
   • the variable is marked as a secret;
   • the output is indeed the terminal stream;
   • no transformation or splitting of the value occurred.

Recommended Practices

• Never echo secrets or write them to files that might be logged or stored.
• Pass secrets via environment inheritance, stdin, or short‑lived temporary files.
• Enable redaction in your testing frameworks (e.g., Jest’s jest-logger or Python’s pytest-sugar).
• Rotate any secret that has appeared in any log, even if it was masked.
• For critical secrets, consider using GitPod’s dedicated secret store or an external vault and avoid printing them entirely.

What We Need to Confirm

If you are seeing an unmasked value, please tell us where the leak appears (terminal, task log, prebuild log, or elsewhere). That detail will determine the exact fix.