Sensitive Data: GitLab Personal Access Token Leak in JavaScript Bundle¶

Identifier: js_data_leak_gitlab_pat

Scanner(s) Support¶

Description¶

GitLab personal access tokens embedded in JavaScript bundles can let attackers access projects, repositories, and APIs with the permissions granted to the token. Exposed tokens should be revoked immediately because client-side bundles are readable by any visitor.

How we test: We statically analyze first-party JavaScript bundles for patterns matching GitLab personal access tokens (glpat- prefix).

References:

• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
• CWE-798: Use of Hard-coded Credentials
• GitLab Docs: Personal access tokens

Configuration¶

Example¶

Example configuration:

---
security_tests:
  js_data_leak_gitlab_pat:
    issues_count_limit: 20
    skip: false

Reference¶

issues_count_limit¶

Type : integer

The maximum number of issues to report. Use 0 to report all issues.

skip¶

Type : boolean

Skip the test if true.