Treat a suspected GitLab credential leak as a security incident: identify the credential and what it could access, assess the risk of interrupting dependent services, then revoke or rotate it using the procedure for that credential type. Update every consumer, investigate activity during the exposure window, and address the path that exposed the secret. Removing a leaked copy is not a substitute for invalidating the credential.
What to do first
- Contain and identify the credential. Record where and when it may have been exposed, who owns it, which project, group, account, or runner it belongs to, and its scopes and expiry if known. Check the relevant commit, CI job log, artifact, runner configuration, or external system. Do not paste the secret into a ticket, chat, or command that may itself be logged. GitLab’s incident guidance recommends determining the token type and scope and identifying its owner or responsible team.
- Assess the possible impact and service risk. Map the credential to the systems and automation that use it, and consider what an unauthorised holder could do with its permissions. Revoking a production credential can stop deployments or other automation; GitLab advises weighing security risk against availability impact. Follow your incident-response policy and involve the service owner when needed.
- Revoke or rotate the affected credential. Choose the credential-specific process below. GitLab’s incident guidance says: “Revoke or rotate the token after you have assessed its scope and potential impact.”
- Replace it in every consumer. Update GitLab CI/CD settings, secret stores, deployment systems, developer tools, and integrations that depended on the old value. Test the replacement with the minimum operation needed and monitor for failures. Do not put the token in a URL or plaintext configuration.
- Investigate and preserve a timeline. Note the UTC times of suspected exposure and invalidation, retain relevant records, and review activity during the window. Look for misuse and for changes that could preserve access.
- Close the exposure path. Remove the visible secret from source, logs, or artifacts where feasible, and correct the configuration or workflow that exposed it. Assume someone who could read the value may already have copied it; removal alone does not make that value safe.
Rotate or revoke: which operation should you choose?
| Operation | What it does | Operational effect |
|---|---|---|
| Rotate an access token | Creates a replacement token while retaining the original permissions and scope; the old token becomes inactive immediately. GitLab documents active and inactive token records for audit. | Consumers using the old value stop working until updated. GitLab’s project and group access-token API documentation describes rotation behavior. |
| Revoke a token | Invalidates the credential and removes its access. | Any consumer relying on it loses access. GitLab’s incident guidance recommends weighing production availability risk before revocation. |
Rotation is useful when access must continue under a replacement credential. Revocation is appropriate when the credential should no longer grant access and no replacement is needed. Either action invalidates the exposed value; plan consumer changes accordingly.
As an Amazon Associate I earn from qualifying purchases.
How to handle each GitLab credential type
| Credential | Scope and typical use | Response |
|---|---|---|
| Personal, project, or group access token | Access belongs to a user, project, or group, according to the token type and permissions. | Rotate or revoke using the applicable access-token page or API. For project tokens, GitLab documents Settings > Access tokens for Maintainers and Owners. See the steps below. |
| Deploy token | Used for Git operations, registries, or packages; may be associated with a project or group. | Revoke it in the relevant project or group settings. Find its consumers first if continued access is required. |
| Runner authentication token | Authenticates a GitLab Runner; the token is stored in the runner’s local config.toml. |
GitLab’s documented manual recovery is to delete the compromised runner and create a new one, which receives a new authentication token. |
| Legacy runner registration token | Used to register runners through a legacy workflow. | Reset it in the project’s runner settings to prevent new registrations using the old value. This does not replace recovery for an already compromised runner authentication token. |
CI_JOB_TOKEN |
Generated for an individual job. | It is valid while that job runs and expires when the job finishes. Investigate what the job could access and rotate any exposed long-lived secrets. |
| User or bot account credentials and SSH keys | May enable account access or Git operations, with reach determined by the account’s permissions and keys. | If the account may be compromised, block it, reset its password and credentials it could access, investigate, and review its SSH keys. |
Personal, project, and group access tokens
For a project access token, a Maintainer or Owner can open the project’s Settings > Access tokens page and rotate or revoke it. Rotation preserves the token’s existing permissions and scope, creates a replacement, and immediately makes the old value inactive. Update all dependent clients promptly; GitLab keeps active and inactive records for audit.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →GitLab documents these rotation API endpoints: POST /projects/:id/access_tokens/:token_id/rotate and POST /groups/:id/access_tokens/:token_id/rotate. Rotating another token requires a personal access token with the api scope; self-rotation requires the token to have api or self_rotate. If the credential used to perform the rotation may itself be exposed, use an appropriately trusted administrator or operator credential under your incident policy rather than relying on a questionable control credential.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
GitLab CLI documentation describes glab token rotate for user, group, or project access tokens and warns that the old token stops working immediately. Check the documentation for the installed CLI version before using it, and have a safe way to update dependent clients.
Deploy tokens
Revoke a project deploy token in the project’s repository settings; a Maintainer or Owner is required. Revoke a group deploy token in the group’s settings; GitLab documents that this requires the Owner role. Deploy tokens may be long-lived and can be exposed by insecure runners, so identify pipelines, deployments, package clients, and other consumers before removing one if continued access is needed.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Also check whether the special gitlab-deploy-token is involved: eligible project jobs may receive its CI_DEPLOY_USER and CI_DEPLOY_PASSWORD variables. Review relevant variables and pipelines as part of impact assessment.
Recommended Free Tools
Runner credentials and registration tokens
For an exposed runner authentication token, GitLab’s documented manual reset is to delete the runner and create a new runner. Investigate whether someone could read the runner’s config.toml or access it through jobs or runner infrastructure. Secure the replacement runner and review its configuration before returning it to service.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
For a legacy project runner registration token, open Settings > CI/CD > Runners and use the menu beside the new project runner control to reset it. GitLab labels registration-token workflows legacy and recommends the newer runner creation and authentication-token workflow. Resetting a registration token only prevents new registrations using that value; it does not rotate the authentication token of an existing compromised runner.
CI_JOB_TOKEN
GitLab creates a unique job token for each job. Since it expires when the job finishes, assess the job’s code, logs, recent repository changes, and available audit events to understand what may have happened while it was valid. Determine which other secrets the job could read and rotate any that may have been exposed. Expiry limits future use of that particular job token; it does not establish that the job or its accessible secrets were harmless.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Compromised user or bot account
GitLab’s incident guidance recommends blocking a suspected compromised account, resetting its password and credentials it could access, enabling two-factor authentication (2FA), and considering enforcement. Unblock the account only after investigation and mitigation. A Maintainer or Owner may have access to protected CI/CD variables and runner registration tokens, so include those in the review. Inspect and remove unauthorised SSH keys where relevant.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteInvestigate use and persistence
Review the records available to your role, deployment, GitLab version, and tier. Audit-event availability and credential inventory may vary, so do not assume every installation exposes the same history or interface.
Quick Recap
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- Check audit events for newly created users, personal, project, or group tokens; project-setting changes; code changes; and CI/CD variable changes.
- Review CI activity, pipeline configuration, job logs, and artifacts for suspicious execution or unintended secret disclosure.
- Trace suspicious file and configuration changes through commit history, and inspect runner and integration activity during the exposure window.
- Look for persistence such as attacker-created accounts, tokens, or SSH keys, and review what the exposed credential could have changed.
Reduce the chance of another exposure
- Use the least powerful credential that works. GitLab’s CI token guidance orders common choices from lower to broader access as job tokens, project tokens, then group tokens. Avoid personal access tokens in CI variables where possible.
- Store secrets safely. Use secrets storage where available. Set sensitive CI/CD variables to protected, masked, and hidden where applicable, and ensure the relevant jobs and branches are governed appropriately.
- Keep secrets out of URLs, plaintext, logs, and artifacts. A token embedded in a Git URL can persist in
.git/config, and URL-bearing requests may be recorded by infrastructure. Avoid writing secrets into commands or output that may be retained. - Harden runners and pipeline controls. Review who can edit pipelines, variables, and project or group settings. GitLab warns that insecure runner configurations can allow one job to steal tokens from another.
- Make credentials identifiable and reviewable. Use token names and descriptions that indicate purpose, resource, environment, and consumer without including personal or sensitive information. Regularly inventory active credentials and revoke those no longer needed.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
