Secret Detection update: Leaked Personal Access Tokens will soon be revoked
Jan 4, 2023Connor Gilbert

Summary
This post introduces the automatic revocation of leaked Personal Access Tokens (PATs) found in public repositories by GitLab Secret Detection. It details the conditions under which revocation occurs (public projects, default branch, `glpat-` prefix), the user notification process, and the impact on security reporting. It also outlines the rollout plan for GitLab.com and Self-Managed instances and provides guidance on how users can get protected by enabling Secret Detection and enforcing scan execution. The post also mentions future enhancements to Secret Detection.
More from the Security Control Framework trail
- Track organization-wide security risk in one dashboard
- Dependency Firewall: Block risky packages before the build
- Two front doors: Module-level access in a Django GRC app
- How GitLab tracks vulnerabilities through refactors and reformatting
- Shai-Hulud copycat campaign targets Python developers through PyPI typosquatting