With https://gitlab.com/gitlab-org/gitlab/-/merge_requests/20968+, Siemens added a token prefix for PATs that was configurable at instance-level to make it easier to identify instance-specific leaks, for example for use with tools like gitleaks and GitHub's secret scanning programs (https://docs.github.com/en/developers/overview/secret-scanning-partner-program). It would be great if we were able to prefix all tokens for self-managed instances to distinguish them from GitLab SaaS and other self-hosted instances. Example:\ https://gitlab.com/gitlab-org/gitlab/-/blob/7bcc0888949a15d1ecbc188cd00832b822e092b0/app/models/ci/trigger.rb#L9 ### Proposal Provide a way to customize token prefixes for all tokens, so that specific instance token leaks can be identified. UPDATE: As agreed in https://gitlab.com/gitlab-org/gitlab/-/issues/388379#note_2486405365, we will introduce ability for instances to provide an instance on top of existing prefix. So `glpat-` becomes `SIE-glpat` if the instance provides an `SIE` instance prefix. All other GitLab instances are not affected. ~~For example, adding `SIE-` as a prefix for all kinds of tokens would distinguish the pattern from GitLab.com's pattern of `gl` :~~ | Token Type | Status Instance Prefix | MR | Team | Respective EMs, PMs and AppSec SC | |------------|------------------------|----|------|-----------------------------------| | Personal access token | :white_check_mark: | https://gitlab.com/gitlab-org/gitlab/-/merge_requests/211171 | ~"group::authentication" | Already involved in this issue | | Impersonation token | :white_check_mark: | https://gitlab.com/gitlab-org/gitlab/-/merge_requests/211171 | ~"group::authentication" | Already involved in this issue | | Project access token | :white_check_mark: | https://gitlab.com/gitlab-org/gitlab/-/merge_requests/211171 | ~"group::authentication" | Already involved in this issue | | Group access token | :white_check_mark: | https://gitlab.com/gitlab-org/gitlab/-/merge_requests/211171 | ~"group::authentication" | Already involved in this issue | | Feed token | :white_check_mark: | https://gitlab.com/gitlab-org/gitlab/-/merge_requests/179852 | ~"group::authentication" | Already involved in this issue | | Path dependent feed token | :white_check_mark: | https://gitlab.com/gitlab-org/gitlab/-/merge_requests/192630 | ~"group::authentication" | Already involved in this issue | | OAuth Application Secret | :white_check_mark: | https://gitlab.com/gitlab-org/gitlab/-/merge_requests/187852 | ~"group::authentication" | Already involved in this issue | | Deploy token | :white_check_mark: | https://gitlab.com/gitlab-org/gitlab/-/merge_requests/186538 | ~"group::environments" | @nmezzopera @nagyv-gitlab @ameyadarshan Please see [the discussion below](https://gitlab.com/gitlab-org/gitlab/-/issues/388379#note_2388754047) for context | | Runner authentication token | :white_check_mark: | https://gitlab.com/gitlab-org/gitlab/-/merge_requests/206149 | ~"group::runner" | @nicolewilliams @DarrenEastman @cmaxim Please see [the discussion below](https://gitlab.com/gitlab-org/gitlab/-/issues/388379#note_2388754047) for context | | CI/CD Job token | :white_check_mark: | https://gitlab.com/gitlab-org/gitlab/-/merge_requests/207268 | ~"group::pipeline security" & ~"group::authentication" | @shampton @jocelynjane @greg Please see [the discussion below](https://gitlab.com/gitlab-org/gitlab/-/issues/388379#note_2388754047) for context | | Trigger token | :white_check_mark: | https://gitlab.com/gitlab-org/gitlab/-/merge_requests/195007 | ~"group::pipeline execution" | @carolinesimpson @rutshah Please see [the discussion below](https://gitlab.com/gitlab-org/gitlab/-/issues/388379#note_2388754047) for context | | Incoming mail token | :white_check_mark: | https://gitlab.com/gitlab-org/gitlab/-/merge_requests/186799 | ~"group::authentication" | Already involved in this issue | | GitLab agent for Kubernetes token | :white_check_mark: | https://gitlab.com/gitlab-org/gitlab/-/merge_requests/203074 | ~"group::environments" | @nmezzopera @nagyv-gitlab @ameyadarshan Please see [the discussion below](https://gitlab.com/gitlab-org/gitlab/-/issues/388379#note_2388754047) for context | | GitLab session cookies | :white_check_mark: | https://gitlab.com/gitlab-org/gitlab/-/issues/439945 | ~"group::authentication" | Already involved in this issue | | SCIM Tokens | :white_check_mark: | https://gitlab.com/gitlab-org/gitlab/-/merge_requests/215766 | ~"group::authentication" | Already involved in this issue | | Feature Flags Client token | :white_check_mark: | https://gitlab.com/gitlab-org/gitlab/-/merge_requests/187059 | ~"group::environments" | @nmezzopera @nagyv-gitlab @ameyadarshan Please see [the discussion below](https://gitlab.com/gitlab-org/gitlab/-/issues/388379#note_2388754047) for context | | Workspace Tokens | :white_check_mark: | https://gitlab.com/gitlab-org/gitlab/-/merge_requests/216506 | | | ### Intended users * Ingrid (Infrastructure Operator) * Sam (Security Analyst) * probably more :)