Rules / GL027

GL027 Secret-like variable with a value committed in the pipeline file

Severity: warn
OWASP: CICD-SEC-6 – Insufficient Credential Hygiene
CWE: CWE-798 – Use of Hard-coded Credentials

What glsec checks

glsec flags a variable in long form (a mapping with value:, usually with description:) whose name ends with a secret-like suffix (_TOKEN, _SECRET, _PASSWORD, _PASSWD, _PASS, _PWD, _KEY, _CREDENTIAL, _CERT) and whose value: is a literal. It checks top-level variables:, default: and jobs.

The long form is what pre-fills the Run pipeline form. A secret-like value there is in the repository for everyone who can read it, in the form for everyone who can run a pipeline, and in the job log whenever a command prints it. .gitlab-ci.yml has no way to mask it: masked is not a keyword under variables: (gitlab#424209 asks for one). Only CI/CD variables set in the project, group or instance settings can be masked.

Not flagged:

• a long-form variable with only description:, or an empty value:: the person running the pipeline supplies the value
• a value: that references another variable ($PROJECT_DEPLOY_TOKEN); re-exporting secrets is GL018
• obvious placeholders (changeme, example, redacted, ...)
• values in a known token format (glpat-, ghp_, AWS keys, ...): GL006 reports those as error
• the short form (POSTGRES_PASSWORD: postgres). In real pipelines a secret-like name with a literal short-form value is nearly always a throwaway password for a service container or a test mock; real tokens in that form are caught by GL006's formats.

Before 1.23.0 this rule recommended adding masked: true to the variable. That keyword doesn't exist, and GitLab's schema rejects it.

Trigger example

variables:
  DEPLOY_PASSWORD:
    value: "staging-pw-2024"
    description: "Password for the staging deploy user"

deploy:
  script:
    - ./deploy.sh

Safe alternative

Store the secret as a masked (and, for deploys, protected) CI/CD variable in Settings → CI/CD → Variables. If the pipeline is run by hand and the value should be typed in, keep only the description:

variables:
  DEPLOY_PASSWORD:
    description: "Password for the staging deploy user (leave empty to use the masked project variable)"

deploy:
  script:
    - ./deploy.sh

References

• GitLab docs: Mask a CI/CD variable
• GitLab docs: variables:description
• GL006: hardcoded secret value in variables: block
• GL018: secret variable re-exported at pipeline level
• GL021: secret variable printed to job log via echo/printf

Documentation for glsec 1.23.0. Source of this page · Rule implementation