CI/CD Variables

Exposed GitLab Email Addresses Could Allow Attackers to Create Merge Requests and Push Code

Aikido warned that email addresses for the GitLab feature that sends work items to projects are sometimes published in public documentation, potentially allowing attackers to create issues and merge requests with the victim account’s permissions. Depending on the account’s privileges, this could enable code modification, CI/CD job execution, or access to private repositories and secrets.