GitLab’s non-expiring incoming email token can let a holder commit code with a user’s permissions and trigger CI/CD jobs.

A long-lived token embedded in GitLab’s issue-creating email address means anyone with the address, not just the project ...

Joe Montana's firm put $100,000 into GitLab in 2015. By its 2021 IPO at about $11 billion, the start-up was growing fast but ...

GitLab’s “Email work item to this project” feature can become a repository-compromise primitive when its private address is exposed, according to research published by Aikido Security researcher Joe ...

GitLab Duo CLI, now in public beta, lets developers automate an open-ended objective to a governed agentic flow that runs locally and verifies its own work, so a develope ...

A GitLab feature designed to let users create work items through email can be abused as an account-level code delivery ...

GitLab released emergency updates for two critical flaws enabling authenticated users to execute arbitrary code via crafted ...

These email addresses, part of GitLab's "Email work item to this project" feature, contain long-lived tokens that act as ...

An exposed GitLab token had Owner-level access to 55 projects, including GnuTLS. The token could have pushed code to an official GnuTLS release without approval. A faulty GitLab CI process published ...

The version control platform GitLab for software projects is vulnerable through several security flaws. In the worst case, ...

Cyber Magazine examines DevSecOps solutions which ensure cybersecurity is at the heart of development operations instead of ...

At DevDay 2026, OpenAI gave Codex reusable cloud environments, automatic security scans for GitHub repositories, and a code ...