GitLab’s non-expiring incoming email token can let a holder commit code with a user’s permissions and trigger CI/CD jobs.

It turns out that cyber-threat actors can do quite a bit of damage with nothing more than an email address. New research from Aikido Security published today examines how a GitLab incoming email ...