CircleCI Security

CircleCI provides masked environment variables, OIDC for cloud authentication, context-based secret management, and SSH debugging with audit trails. Security features scale across Free, Performance, and Scale plans.

Environment variables can be masked to hide values in logs. Contexts provide reusable, shareable secret sets across projects with granular access control. Contexts can be restricted to specific security groups. OIDC tokens for AWS, GCP, Azure, and Vault.

Jobs run in isolated VMs or containers with dedicated network interfaces. Docker Layer Caching uses isolated volumes. Self-hosted runners (Scale plan) run in customer VPCs with custom network policies. IP ranges published for allow-listing.

Orbs are scanned for vulnerabilities. Config validation prevents malicious YAML. Dependency scanning via Snyk orb. Container image scanning via Trivy/Anchore orbs. SBOM generation with Syft. Cosign signing for artifacts.

Audit logs capture all user and system actions. Insights API provides programmatic access to build metrics and security data. SOC 2 Type II certified. Data residency options (US, EU). IP allow lists and SSO/SAML on Performance/Scale plans.

Scale plan ($2000/mo) enables self-hosted runners in customer infrastructure. Runner launch agents run as non-root. Ephemeral runners with automatic cleanup. GPU and ARM runner support. Custom images with hardened base.