Introducing Token-Hunter

This post introduces Token-Hunter, a new tool developed by GitLab's Red Team to identify unintentionally leaked secrets (API tokens, usernames, passwords) in public GitLab assets such as issues, snippets, merge requests, and their discussions. It complements existing tools by focusing on these less-indexed public locales. The tool features proxying capabilities and employs request retries and dynamic page-size reduction for data gathering. Future plans include support for more asset types and improved output formatting.