Secret Variables

Secret Variables

Script source is stored in plain Forge storage, snapshotted on every save, and readable by every admin from the editor and the version history. A token pasted into a script is a token written to all of those places, permanently. Secret variables are the alternative: a name/value pair whose value goes to Forge's encrypted store instead of into your source.

Script variables page listing three secret variables with masked values

Variables tab with masked values

## Create a variable
  1. Open the Variables tab and choose Create script variable.
  2. Give it a name such as SLACK_TOKEN — an uppercase letter first, then uppercase letters, digits or underscores, up to 64 characters.
  3. Paste the value and save.

The list shows each name with its value masked to length. A value is fetched only when you press the reveal control on that row, one variable at a time. Each row can also copy the variables.get('NAME') snippet for you.

Read it from a script

const token = await variables.get('SLACK_TOKEN');   // null if it does not exist
if (!token) return { error: 'Define SLACK_TOKEN on the Variables tab first.' };

const names = await variables.list();              // names only, never values

Scripts can read variables, never create or change them — that happens on the Variables tab.

Leaked values are scrubbed

console.log(await variables.get('SLACK_TOKEN')) is an easy mistake. Every value handed to a run is remembered for that run, and any that reappears in the logs, the returned value or the error is replaced with [redacted: SLACK_TOKEN] before the response leaves the function. Run history records which variable names a run read, never their values.

What this does and does not protect

Be clear about the boundary:

  • It is a safety net, not a wall. Anyone who can write a script here is a Jira admin who could read every variable deliberately. Redaction catches exact matches only — a reversed or re-encoded value is not caught.
  • Values under 6 characters are not scrubbed, because masking every occurrence of a short string would corrupt unrelated output far more often than it would protect anything.
  • The Scriptbox Assistant's test runs can read variables. When the Rovo assistant test-runs a script it wrote, variables.get() works, and the run's output is returned into the chat. See Scriptbox Assistant (Rovo).
  • Behaviours cannot read variables at all. A behaviour runs in the user's browser, so it is never given them.

The real boundary is that every Variables function checks for Jira admin first. See Security Model.