_Summary: A customer will be able to see the status of a detected GitLab token on the vulnerability page. This includes self-managed users and air-gapped._ ### Out of scope - Filter and sort by token status ### Update Database - add token status to finding ### Add sidekiq worker - Get all project SD findings where status is Active or Unknown and is GitLab PAT token - Check in DB the status on each of these PATs - Update the status in the Vulnerabiliy finding - Ensure the worker runs after the report ingestion worker ### Extend for all GitLab tokens ## Proposal To enhance security visibility and token management, we propose integrating GitLab token status information directly into vulnerability reports. This integration will allow security teams and developers to quickly identify potential security risks related to authentication tokens while reviewing vulnerability data. When a Security Dynamic scan is executed and its report is ingested, a Sidekiq worker will be triggered automatically. This worker will: 1. Process all GitLab tokens discovered during the scan 2. Check each token's current status in the Database 3. Assign one of three status values to the corresponding vulnerability finding: - Unknown: Status check could not be completed - Active: Token is currently active - Inactive: Token is no longer active The token status and date of verification will be displayed on the vulnerability finding show page, providing immediate visibility into the state of discovered GitLab tokens. To give users control over this feature, an opt-in setting will be added to the Security Configuration page. This will allow organizations to enable or disable the token status checking functionality according to their security needs. A spike exploring a possible implementation can be found at https://gitlab.com/gitlab-org/gitlab/-/merge_requests/181764+s. ```mermaid sequenceDiagram participant SD as Pipeline SD Scan participant RW as Report Ingestion Worker participant TW as Token Status Worker participant DB as Database Note over SD: gl-secret-detection-report.json SD->>RW: Trigger report ingestion RW->>TW: Trigger token status check TW->>DB: Query token status in Database DB-->>TW: Return status TW->>DB: Update finding in Database