lolcreds

Public credential defaults and exposure patterns for authorized security testing.

CircleCI

CircleCICI/CD3 credentials

Credentials3 documented
01

Personal API Token

circleci / personal-api-token

CircleCI users create personal API tokens for API and CLI access.

generated on installuser definedsecretAPI key

Looks like

example
example

CircleCI personal API token shape from public scanner rules

CCIPAT_ABCDEFGHIJKLMNOPQRSTUV_abcdef0123456789abcdef0123456789abcdef01
pattern

Contextual CircleCI legacy/project token shape from Betterleaks

(?i)(?:circleci)(?:[ \w.-]{0,20})[\s'"]{0,3}(?:=|>|:{1,3}=|\|\||:|=>|\?=|,)[`'"\s=]{0,5}([a-f0-9]{40})(?:\?['"`]|[\s;]|\[nr]|$)

Location

http header
Circle-Token

CircleCI API token header

http header
Authorization

Basic or token-based CircleCI API authentication

config file
~/.config/circleci/config.yml, .circleci/config.yml

CircleCI CLI config and pipeline config references

environment
CIRCLE_TOKEN, CIRCLECI_TOKEN
secret store

CI/CD variables, password managers, and cloud secret managers

source code

automation scripts and accidentally committed configs

logs

curl traces, CLI debug logs, and job output

02

Project / Context Environment Variable Secret

circleci / project-context-env-var

CircleCI projects and contexts store environment variables used by jobs, including deploy keys, cloud tokens, package credentials, and passwords.

user definedsecretsecret value

Location

config file
.circleci/config.yml

CircleCI pipeline config referencing contexts and environment variable names

secret store

CircleCI project environment variables and organization contexts

source code

.circleci/config.yml references to secret variable names

logs

job output if commands print secret values or xtrace is enabled

Notes

Environment variable storage noted but omitted from CredsHound location data because no exact variable name is documented: runtime job environment variables injected by CircleCI

03

SSH Key / Deploy Key

circleci / ssh-key-and-deploy-key

CircleCI can store SSH keys for checking out private repositories or deploying from jobs.

user definedgenerated on installsecretkey pair

Looks like

pattern
pattern

private SSH key stored for CircleCI job use

-----BEGIN (RSA |EC |OPENSSH |ENCRYPTED )?PRIVATE KEY-----

Location

secret store

CircleCI project SSH keys and deploy key storage

config file
.circleci/config.yml

CircleCI job config referencing add_ssh_keys fingerprints

source code

.circleci/config.yml and setup scripts

logs

SSH debug output and accidental key prints

Scope

Authorized use

LOLCreds helps map the credential surface of real products: known defaults, generated values, credential locations, and exposure patterns.