Rules / GL014

GL014 dotenv artifact capturing all environment variables

Severity: warn
Minimum GitLab version: 12.9 (artifacts: reports: dotenv: was introduced in 12.9)
OWASP: CICD-SEC-6 – Insufficient Credential Hygiene

What glsec checks

glsec flags jobs that combine two things:

1. A script line that dumps all environment variables to a file (env > or printenv >)
2. An artifacts: reports: dotenv: entry that uploads that file as a pipeline artifact

This makes CI_JOB_TOKEN, masked CI/CD variables, and any other secrets present in the job environment downloadable by any project member who can access pipeline artifacts.

Trigger example

build:
  script:
    - make build
    - env > build.env          # captures CI_JOB_TOKEN, AWS_SECRET_ACCESS_KEY, etc.
  artifacts:
    reports:
      dotenv: build.env        # downloadable by any pipeline viewer

Safe alternative

Export only the specific variables that downstream jobs need:

build:
  script:
    - make build
    - echo "BUILD_VERSION=$BUILD_VERSION" > build.env
    - echo "IMAGE_TAG=$CI_COMMIT_SHORT_SHA" >> build.env
  artifacts:
    reports:
      dotenv: build.env

Why this matters

GitLab's dotenv report artifact is designed to pass a small set of computed values (e.g. a generated version string) to downstream jobs. When env > is used instead, the artifact contains every variable in the job environment, including:

• CI_JOB_TOKEN — a scoped GitLab API token
• All CI/CD variables, even those marked as masked (masking only applies to logs, not artifact files)
• Cloud provider credentials, deploy keys, and any other secret injected into the job

Any project member with the Reporter role or above can download pipeline artifacts through the GitLab UI or API.

See also

Enable the ShellCheck integration to surface additional shell issues in these script blocks.

Documentation for glsec 1.23.0. Source of this page · Rule implementation