GitLab native secrets manager boosts supply chain security
May 20, 2024Jocelyn Eillis

Summary
This post announces the upcoming native GitLab Secrets Manager, detailing its planned features and integrations. It highlights the current reliance on third-party solutions and the motivation for a native offering. Key planned integrations include automatic placement of detected secrets and access tokens into the manager, integration with audit logging for compliance, and securing credentials for verifiable artifact attestation. The post also mentions the use of an open-source secrets manager (OpenBao) and the intention to support multiple secret management solutions.
More from the GitLab Secrets Manager trail
- GitLab Secrets Manager adds ESO, Terraform, API support
- Manage CI/CD credentials with GitLab Secrets Manager
- A leaked personal access token shouldn't expose every project its owner can reach. Fine-grained PATs scope each token’s permissions to the job.
- Solving complex challenges with GitLab Duo Workflow
- How to scan a full commit history to detect sensitive secrets