Rules / GL010

GL010 Secrets forwarded to downstream pipeline

Severity: warn
Minimum GitLab version: 14.9 (trigger: forward: was introduced in 14.9)
OWASP: CICD-SEC-6 – Insufficient Credential Hygiene

What glsec checks

glsec flags trigger: jobs that set forward: pipeline_variables: true, which forwards all parent pipeline variables — including masked secrets set in CI/CD Settings — to the downstream project's pipeline.

Trigger example

trigger-downstream:
  trigger:
    project: org/downstream-project
    forward:
      pipeline_variables: true   # all variables forwarded, including secrets

Safe alternative

Pass only the variables the downstream pipeline needs, and disable implicit variable inheritance:

trigger-downstream:
  trigger:
    project: org/downstream-project
  variables:
    DEPLOY_ENV: production        # explicit, minimal variable passing
  inherit:
    variables: false              # do not inherit parent pipeline variables

Why this matters

GitLab's own documentation explicitly warns:

"Do not use this method to pass masked variables to a multi-project pipeline. The CI/CD masking configuration is not passed to the downstream pipeline and the variable could be unmasked in job logs."

When pipeline_variables: true is set:

• Every CI/CD variable from the parent pipeline is forwarded, including secrets marked as masked or protected
• Masking is not applied in the downstream pipeline — secrets can appear in plain text in job logs
• The downstream project may have a broader set of maintainers and less strict access controls
• A malicious job in the downstream project can trivially exfiltrate all forwarded secrets

Documentation for glsec 1.23.0. Source of this page · Rule implementation