Feature Requests

When adding a new project through CircleCI, a read-only deploy key is automatically configured for the project to allow CircleCI to immediately start checking out code and building our projects.We would like this option extended so that CircleCI can automatically manage projects that may need read-write privileges by default; for example, a build workflow might have some logic to automatically apply git tags to the current branch after a build.Without this capability, we are stuck manually adding user keys to every repository that needs this. It may work for a few repos, but if you need to manage dozens or even hundreds of repos with this capability, you can see how this can get unwieldy. CCI-I-1416

Enable a setting to restrict the "Rebuild with SSH" action to only administrators (role on Github Team) CCI-I-823

Add the ability to record and stream shell commands and outputs from "Rerun job with SSH" sessions to customer-owned S3 buckets for SIEM ingestion and forensic analysis. THE SECURITY CONCERN When someone initiates "Rerun job with SSH," they gain access to the build environment where environment variables (secrets, API keys, credentials) may be accessible. If an account is compromised or a bad actor gains access, they could dump credentials using printenv or env, exfiltrate sensitive data, or take actions that wouldn't be logged or detected. Without session recording, security teams have no forensic trail to understand what occurred during an incident. CUSTOMER SCENARIO Customer (enterprise SaaS company) has flagged SSH rerun as a security risk. Their infosec team wants to stream session activity to S3 for SIEM ingestion (Sumo Logic/Datadog), create alerts for suspicious commands, have forensic evidence for incident response, and meet compliance requirements for audit trails. CURRENT WORKAROUNDS AND GAPS Context Expression Restrictions (not job.ssh.enabled) can block sensitive credentials during SSH sessions, but this reduces debugging utility and doesn't provide visibility. Audit Log Streaming captures session metadata but not session content. Disabling SSH entirely eliminates the risk but removes a valuable debugging tool. REQUESTED CAPABILITY Ideal: Native session recording similar to AWS Session Manager. Capture all shell input (commands typed) and stdout/stderr output. Stream to customer-owned S3 bucket in near real-time. Structured format (JSON) for easy SIEM ingestion. Alternatives: JIT approval workflow for SSH sessions, webhook notifications when SSH sessions start, or integration with third-party session recording tools.

We'd like to implement custom webhooks to get data from our workflows/ jobs into their logs. We would like to them to include the runner's name on the response

CircleCI audit logs track actions like creating contexts and triggering workflows, but don't capture user login events. This creates a gap for security teams who need to monitor all platform access. Problem: * Can't track users who log in but don't trigger builds * No way to see who accessed CircleCI during a given period * Current "Active Users" only shows users who trigger work * Missing visibility into authentication patterns and potential security incidents Requested Events: user.logged_in - Successful authentication Use Case: Enable security teams to monitor all platform access, track login patterns, and automate access reviews via audit logs and API.

This is a request to include IP Addresses in Audit Logs, or to have the option to include them.

Vault supports features like dynamic secrets generation, where you could create AWS keys that were only good for a limited time. Instead of long-lived creds stored as environment variables, you can update them every day, or every CI/CD run. CCI-I-1069

When creating a new user account for an SSO enabled org, the user needs to create an account then join the organization via SSO. It would reduce user onboarding confusion if the new user was automatically routed to authenticate with their organization.

Currently group grants can only be assigned to a project. It would be helpful if an a group grant could be given on an org level, to allow for an admin group to be created.

Adding session tags or allowing for them to be added would allow for consolidation of roles. Currently a role needs to be created per project in some situations. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_adding-assume-role-idp