GitLab’s non-expiring incoming email token can let a holder commit code with a user’s permissions and trigger CI/CD jobs.

A long-lived token embedded in GitLab’s issue-creating email address means anyone with the address, not just the project owner, can push code and trigger CI/CD jobs subject to the account’s existing ...

There's more to GitLab than just Git. GitLab has built an entire ecosystem around the Git version control tool that includes everything from YAML-based CI/CD pipelines to AI-powered pair-programming ...

A security researcher hijacked hundreds of GitLab domains in just a few seconds by exploiting a weakness in how the company handles domain verification — a security issue that the company has now ...