glsec

Rules / GL028

GL028 artifacts: untracked: true without path restriction

Severity: warn
OWASP: CICD-SEC-7 – Insecure System Configuration

What glsec checks

glsec flags jobs that set artifacts: untracked: true without also setting artifacts: paths: or artifacts: exclude:. Without a restriction, GitLab archives every file that git does not track — including .env files, generated private keys, temporary credential files, .git/config with embedded tokens, and build outputs containing secrets. These artifacts are stored by GitLab and downloadable by anyone with project access.

The finding is suppressed when either paths: (restricts what is uploaded) or exclude: (explicitly filters sensitive patterns) is present alongside untracked: true.

Complements GL005, which flags sensitive file patterns already present in artifacts: paths:.

Trigger example

build:
  script:
    - make build
  artifacts:
    untracked: true   # archives everything git doesn't track, including .env, *.key, etc.

Safe alternatives

Restrict to explicit paths (preferred):

build:
  artifacts:
    paths:
      - dist/
      - build/
    expire_in: 1 week
  script:
    - ./build.sh

If untracked: true is required, add an exclude list:

build:
  artifacts:
    untracked: true
    exclude:
      - "**/.env"
      - "**/*.key"
      - "**/*.pem"
      - "**/credentials*"
  script:
    - ./build.sh

References

Documentation for glsec 1.23.0. Source of this page · Rule implementation