Bitbucket Secured Variable Leaked / Not Masked in Logs

By Kaveh Alemi·Latchkey

Bitbucket masks the values of variables marked "secured" wherever they appear verbatim in logs. A variable not marked secured, or a value transformed before printing, slips through unmasked.

What this error means

A token or password shows up in plain text in a step log. Either the variable was added without the secured flag, or the script printed a derived form (base64-encoded, embedded in JSON) that the verbatim masker does not recognize.

+ echo "Authorization: Bearer abc123tokenvalue"
Authorization: Bearer abc123tokenvalue   # printed in clear text

Common causes

Variable not marked secured

Only variables flagged secured are masked. A sensitive value added as a plain variable is printed verbatim wherever it appears.

Value transformed before printing

Masking matches the exact secured value. A base64-encoded, URL-encoded, or JSON-embedded form of the secret does not match the stored string and is not masked.

How to fix it

Mark the variable secured and stop echoing it

1. In Repository/Workspace settings → Variables, enable "Secured" for the secret.
2. Remove any echo/debug line that prints the value or a transform of it.
3. Re-run; the verbatim value is now masked in logs.

Avoid printing derived forms of secrets

Do not log encoded or embedded versions of a secret; masking only catches the exact stored value.

script:
  # do NOT do this - base64 form is not masked
  # - echo "$TOKEN" | base64
  - curl -H "Authorization: Bearer $TOKEN" "$API_URL"

How to prevent it

• Mark every sensitive variable as secured.
• Never echo secrets or transformed forms of them.
• Rotate any credential that appeared in a build log.

Frequently asked questions

Related guides

References

• GitHub Actions documentation