Companies are being urged to update 0Auth, runner, and project API tokens, along with other secrets stashed with CircleCI.