Rules / GL005

GL005 Sensitive artifacts

Severity: error (sensitive paths, absolute paths, path traversal) / warn (missing expire_in)
OWASP: CICD-SEC-6 – Insufficient Credential Hygiene
CWE: CWE-23 – Relative Path Traversal

Risk

Storing secrets in job artifacts exposes them to anyone with read access to the project and its pipelines. Absolute paths and path traversal sequences can exfiltrate arbitrary host files on shell-executor runners. Missing expire_in keeps artifacts indefinitely, compounding the exposure window.

What is flagged

Applies to artifacts:paths: and artifacts:exclude: at default: and job level.

Absolute paths (error):

A path starting with / references the host filesystem directly. On a shell executor this can exfiltrate any file the runner user can read.

Path traversal (error):

A path containing ../ attempts to escape the project directory.

Sensitive file patterns (error):

Pattern	Examples
`.env`, `.env.*`	`.env`, `.env.production`
`.pem`, `.der`	`cert.pem`, `ca.der`
`*.key`	`server.key`, `private.key`
`.p12`, `.pfx`, `.jks`, `.keystore`	Certificate keystores
`id_rsa`, `id_ecdsa`, `id_ed25519`, `id_dsa`	SSH private keys
`kubeconfig`, `*.kubeconfig`	Kubernetes config files
`secret`, `*.secret`	Secret file names
`credential`, `credentials`	Credential file names
`password`, `passwd`	Password file names
`*.token`	Token files
`.tfstate`, `.tfvars`	Terraform state and variable files

Missing expire_in (warn):

Any artifacts: block without an expire_in key. Artifacts kept forever increase the blast radius of any sensitive content they contain.

Trigger examples

build:
  artifacts:
    paths:
      - /etc/passwd                   # absolute path — host filesystem
      - ../../etc/shadow              # path traversal — escapes project dir
      - .env                          # sensitive file pattern
      - deploy.pem                    # private key
    # no expire_in — artifacts kept forever
  script:
    - ./build.sh

Safe alternative

build:
  artifacts:
    paths:
      - dist/
      - build/
    expire_in: 1 week
  script:
    - ./build.sh

Never include secret files in artifact paths. Use GitLab CI/CD variables with the Masked flag for secrets.

Notes

Absolute path and path traversal checks are active vulnerability indicators on shell-executor runners; on Docker executors the Runner enforces project-directory boundaries at upload time, making these defence-in-depth catches
Pattern matching for sensitive filenames is case-insensitive and uses glob-style prefix/suffix matching
expire_in is flagged as a separate finding regardless of whether other issues are present

Documentation for glsec 1.23.0. Source of this page · Rule implementation