Skip to content

Review the client-side rule for GitLab Runner Token

Problem

The current client-side Javascript regex for the GitLab Runner Token secret type also matches legacy formats that did not have a constant prefix. Google Doc links can cause false-positives to be detected.

See this discussion for details: !170634 (comment 2485344996)

Solution

  1. Review the data dashboard and determine whether any fix is required
  2. If necessary, only support the newer token type including the hardcoded prefix
Edited by Dinesh Bolkensteyn