DevSecOps Engineer: 2026-09-25

1. Send GitLab an email, push to main

   Aikido Security, 2026-09-23. Read, 11 min.

   Aikido reports that the private address behind GitLab's "Email work item to this project" feature embeds a long-lived token tied to the user's account, and that anyone holding it can push code and run CI/CD jobs in every project the account can reach, bypassing IP restrictions in Aikido's test. Aikido found a dozen such addresses published in READMEs, contributing guides, and support pages, and says GitLab closed its HackerOne report as intended behavior, then updated its UI text and documentation while leaving the mechanism untouched.

   Why it matters for this role: Search repos, docs, and help pages for @incoming.gitlab.com addresses, since one leaked address can push to main and run pipelines in every project its owner can reach.

2. GitHub App Private Keys: 474 Leaked Keys Still Work

   GitGuardian, 2026-09-22. Read, 13 min.

   GitGuardian tested 4,802 GitHub App private keys drawn from more than 500,000 exposed RSA keys and found 474 still authenticating as 440 distinct Apps, 44 of which had organization administration privileges. It reports that 72 percent of the compromised Apps could access private repository content and 207 could modify it.

   Why it matters for this role: Add GitHub App private keys to your secret scanning and rotation routine, since 474 leaked keys still authenticated and some carried control over workflows and self-hosted runners.

DevSecOps Engineer