Some developers are publishing private GitLab email addresses in READMEs, contributing guides and support pages to collect bug reports. According to researchers at application security company Aikido, these addresses carry a credential that attackers can use to act on GitLab as the developer who owns them.

The addresses come from a built-in GitLab feature called "Email work item to this project." GitLab generates them automatically. When someone sends a message to one of these addresses, GitLab turns the email into an issue or task in the project.

The problem is that each address contains a long-lived token tied to the developer's account. This string works as the credential for creating work items by email.

Read More