• Related topics

Client-side secret detection

When you create an issue or epic, propose a merge request, or write a comment, you might accidentally post a sensitive value. For example, you might paste in the details of an API request or an environment variable that contains an authentication token.

When you edit the description or comment in an issue, epic, or merge request, GitLab checks if it contains a sensitive token. If a token is found, a warning message is displayed. You can then edit your description or comment before posting it. This check happens in your browser before the message is sent to the server. The check is always on; you don’t have to set it up.

Your text is checked for the following secret types:

• GitLab personal access tokens
  • If a personal access token prefix has been configured, a token using this prefix is checked.
• GitLab feed tokens

Related topics

• Push rules