GitLab Email Addresses Can Be Weaponized for Supply Chain Attacks (3 minute read)

2026-09-25

GitLab email addresses contain non-expiring tokens, making them a target for supply chain attacks. Leaked addresses can grant owner-level access, allowing merge requests, patch submissions, code pushes to private projects, and IP restriction bypasses. Organizations should proactively rotate GitLab email access tokens and scan for these addresses as critical secrets.