Secrets scrubbing

If a task references a secret or other sensitive value like an OIDC token, RWX will attempt to remove its value from any logs or results produced by the run. If a sequence of bytes in the logs matches one of these values, the sequence will be replaced with asterisks (*******). Note that the length of these asterisks is static regardless of the length of the secret value.

Custom secrets

If you want to mask additional values throughout your run, you can call rwx-runner mask inside a task:

tasks:
  - key: mask-value
    run: |
      rwx-runner mask "${SOME_SENSITIVE_VALUE}" "${ANOTHER_SENSITIVE_VALUE}"
      echo "${SOME_SENSITIVE_VALUE}" # will output ******* to the logs
      echo "${ANOTHER_SENSITIVE_VALUE}" # will output ******* to the logs
    env:
      SOME_SENSITIVE_VALUE: abcdefgh
      ANOTHER_SENSITIVE_VALUE: 12345678

Limitations

  • Values are only matched against their plain-text representation. If the value is encoded in a different format, RWX will not be able to remove it.

  • If a value is written to an artifact, that value will be viewable in plain-text if the artifact is downloaded via the UI or rwx artifacts.

  • If a value has been output to the logs before it is masked with rwx-runner mask, it will not be retroactively scrubbed from the logs.