Ask for another level of verification to check the user's identity. Much like what google and other services do. This issue came forth from https://gitlab.com/gitlab-org/gitlab-ce/issues/21358#note_19121066 ### proposal this feature would be a mix between: [hide-vars](/uploads/77225ab0eb7febb96ac0bf4c24b8bc78/hide-vars.gif) and [Secret_Variable_hidden](/uploads/5eb0b541e130f6207070b6b2c698a2ed/Secret_Variable_hidden.png) [Secret_Variable_unlock](/uploads/e9d8573cc86ab1292c25ff73b83375db/Secret_Variable_unlock.png) cc: @markpundsack @ayufan