Reveal value of secrets #9999

New Issue

GiteaMirror · 2025-11-02T08:55:20-06:00

GiteaMirror commented

2025-11-02 08:55:20 -06:00

Originally created by @JakobDev on GitHub (Dec 20, 2022).

Feature Description

It should be possible to see the value of secrets after creating them. This can help with debugging e.g. to see which API Key is used. This should of course only be possible after a the User clicks on e.g. "reveal value" button like in GitLab.

Screenshots

No response

Originally created by @JakobDev on GitHub (Dec 20, 2022). ### Feature Description It should be possible to see the value of secrets after creating them. This can help with debugging e.g. to see which API Key is used. This should of course only be possible after a the User clicks on e.g. "reveal value" button like in GitLab. ### Screenshots _No response_

GiteaMirror added the type/proposal type/feature labels 2025-11-02 08:55:20 -06:00

GiteaMirror commented

2025-11-02 08:55:21 -06:00

@delvh commented on GitHub (Dec 20, 2022):

I agree, I'm always annoyed by GitHub not allowing it, too.
However, we certainly need to be extra careful about whether the permissions for this are met because no one who isn't an owner may see the value of a secret:
Setting a secret is far less destructive than viewing a secret.

@delvh commented on GitHub (Dec 20, 2022): I agree, I'm always annoyed by GitHub not allowing it, too. However, we certainly need to be extra careful about whether the permissions for this are met because no one who isn't an owner may see the value of a secret: Setting a secret is far less destructive than viewing a secret.

GiteaMirror commented

2025-11-02 08:55:21 -06:00

@silverwind commented on GitHub (Dec 20, 2022):

From a strict security perspective, this is a no-go, but for sloppy security, it might make sense to have an server-side option to enable viewing behaviour, default to off.

@silverwind commented on GitHub (Dec 20, 2022): From a strict security perspective, this is a no-go, but for sloppy security, it might make sense to have an server-side option to enable viewing behaviour, default to off.

GiteaMirror commented

2025-11-02 08:55:21 -06:00

@lafriks commented on GitHub (Dec 31, 2022):

It could be theoretically shown to admin by requesting password or code from 2fa

@lafriks commented on GitHub (Dec 31, 2022): It could be theoretically shown to admin by requesting password or code from 2fa

GiteaMirror commented

2025-11-02 08:55:21 -06:00

@ensc commented on GitHub (Dec 2, 2023):

From a strict security perspective, this is a no-go

that's security-by-obscurity... You can always reveal the value of secrets by printing them in a workflow (which is much more insecure than a "show secret" button because job logs might be public).

@ensc commented on GitHub (Dec 2, 2023): > From a strict security perspective, this is a no-go that's security-by-obscurity... You can always reveal the value of secrets by printing them in a workflow (which is much more insecure than a "show secret" button because job logs might be public).

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#9999