Bitbucket Cloud API Tokens are visible in Bamboo in Bamboo build logs

XMLWordPrintable

    • 3
    • Severity 1 - Critical
    • 2

      Issue Summary

      Bitbucket Cloud API Tokens are visible in Bamboo in Bamboo build logs via variable bamboo.planRepository.repositoryUrl

      Steps to Reproduce

      1) Spin up Bamboo 12.1.7

      2) Generate a new API Token with scopes in Bitbucket Cloud

      3) Save the token in Bamboo as Shared Credentials

      4) Add a new Bitbucket Cloud type linked repository in Bamboo

      5) Create a new plan and add a script task and add the below code to the script task

      echo ${bamboo.planRepository.repositoryUrl}

      6) Go to build logs 

      Expected Results

      The API token should not be visible in the build logs

      Actual Results

      The below exception is thrown in the xxxxxxx.log file:

      command	14-May-2026 08:39:24	Substituting variable: ${bamboo.planRepository.repositoryUrl} with https://x-bitbucket-api-token-auth:************************************************lszQyfc484QpI8d95zsHfCZMa8YwPFFz8CKS_pjXHcA-ISE4mBdXyphr5TFaRQc__xxCEcEjHC-***********************************Eg4LErhYP05SAnJPX_FfOsF0=300F0383@bitbucket.org/abcdef/repoforsession1.git

simple	14-May-2026 08:39:24	Starting task 'Script' of type 'com.atlassian.bamboo.plugins.scripttask:task.builder.script'

command	14-May-2026 08:39:24	Beginning to execute external process for build 'ZTEST - TEST - Default Job #29 (ZTES-TEST-JOB1-29)'\n ... running command line: \n/var/atlassian/application-data/bamboo-agent/temp/ZTES-TEST-JOB1-29-ScriptBuildTask-8474473991743879860.sh\n ... in: /var/atlassian/application-data/bamboo-agent/xml-data/build-dir/ZTES-TEST-JOB1\n

build	14-May-2026 08:39:24 https://x-bitbucket-api-token-auth:************************************************lszQyfc484QpI8d95zsHfCZMa8YwPFFz8CKS_pjXHcA-ISE4mBdXyphr5TFaRQc__xxCEcEjHC-***********************************Eg4LErhYP05SAnJPX_FfOsF0=300F0383@bitbucket.org/abcdef/repoforsession1.git

      Workaround

      Currently there is no known workaround for this behavior. A workaround will be added here when available

              Assignee:
              Victor Debone
              Reporter:
              Shashank Kumar
              Votes:
              1 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: