Introducing compromised password detection for GitLab.com
May 22, 2025Ruby Nealon

Summary
Introduces compromised password detection for GitLab.com users during sign-in. This feature compares the entered password against a database of known compromised credentials. If a match is found, users receive an alert banner and email notification, prompting them to change their password. This applies only to native username/password logins, not SSO. The post also reiterates existing security recommendations: using strong, unique passwords, setting up two-factor authentication, maintaining access to primary email and recovery codes, and registering with services like haveibeenpwned.com.
More from the Security Control Framework trail
- Track organization-wide security risk in one dashboard
- Dependency Firewall: Block risky packages before the build
- Two front doors: Module-level access in a Django GRC app
- How GitLab tracks vulnerabilities through refactors and reformatting
- Shai-Hulud copycat campaign targets Python developers through PyPI typosquatting