Travis CI flaw exposed secrets of thousands of open source projects

Wonderful; at least I've moved 99% of my projects off Travis CI to GitHub Actions by now. I still always use separate credentials for CI systems so I can rotate them quickly in the event of a leak.

But environment secrets are one of the few things that a CI system kind of _has_ to do perfect, otherwise all bets are off.

> Felix Lange found a security vulnerability that caused Travis CI to include secure environment variables of all public open source repositories that use Travis CI into pull request (PR) builds.

This is really bad. The most frustrating part is how predictable Travis CI's decline is, after having been bought by a private equity group. As many people on HN and elsewhere predicted, the days of Travis CI providing a quality service were numbered after being bought by Idera.

Discussions from earlier today:

https://news.ycombinator.com/item?id=28523350

https://news.ycombinator.com/item?id=28524727