GITLAB EMAIL ADDRESSES CAN BE WEAPONIZED FOR SUPPLY CHAIN ATTACKS

Summary from the TLDR InfoSec newsletter

GitLab incoming email addresses embed non-expiring tokens that act as the owner across accessible projects. A leaked address can create merge requests, submit patches, or push code to private projects after changing project identifiers, and can be used to bypass IP restrictions via email. Aikido recommended that organizations reduce their attack surfaces by preemptively rotating the access tokens in their GitLab email addresses and by scanning for these addresses in their development environments and repositories as if they were any other secrets.