Removed: nothing. Secrets stayed in build environments where a modified uploader script could read them.
Outcome: thousands of secrets exposed from customer CI/CD pipelines.
The Codecov breach of 2021 occurred when attackers modified Codecov’s bash uploader to exfiltrate environment variables from customer CI/CD pipelines. This exposed thousands of secrets that customers had in their build environments.
The uploader was a bash script that every customer’s pipeline ran with broad access to its environment variables. That is the structural half of the story: a build step handed its secrets to a third-party script by design, so the only thing standing between a modified script and those secrets was the vendor’s own integrity.
Source: Codecov, security update (14 April 2021)