Manage CI/CD credentials with GitLab Secrets Manager
May 21, 2026Joe Randazzo
Summary
Introduces GitLab Secrets Manager, a new capability built on OpenBao, for managing CI/CD credentials. It allows secrets to be scoped to specific jobs based on environment, branch, and protection status, reducing the blast radius of leaks. Secrets are declared in `.gitlab-ci.yml` using the `secrets:` keyword and are passed to jobs via temporary files. Access control is managed through existing GitLab group and project permissions. Audit logs for secret management and reads are now available.
More from the GitLab Secrets Manager trail
- GitLab Secrets Manager adds ESO, Terraform, API support
- A leaked personal access token shouldn't expose every project its owner can reach. Fine-grained PATs scope each token’s permissions to the job.
- Solving complex challenges with GitLab Duo Workflow
- How to scan a full commit history to detect sensitive secrets
- Best practices to keep secrets out of GitLab repositories