Rules / GL033

GL033 debug logging toggles enabled in committed pipeline YAML

Severity: error (CI_DEBUG_TRACE) / warn (CI_DEBUG_SERVICES)
OWASP: CICD-SEC-6 – Insufficient Credential Hygiene

What glsec checks

glsec flags any variables: block — top-level, default:, or job-level — that commits one of GitLab's debug logging toggles:

• CI_DEBUG_TRACE: "true" (error) — activates set -x shell tracing for the entire job, printing every command with fully-expanded arguments to the job log, including the values of all CI variables, protected and masked alike.
• CI_DEBUG_SERVICES set to a truthy value ("true", true, "1") (warn) — enables verbose logging of service containers, leaking their startup environment and any credentials passed to them (registry auth, database passwords) into the job log.

Committing either creates a persistent secret-dumping configuration accessible to anyone who can retry the pipeline.

Trigger example

variables:
  CI_DEBUG_TRACE: "true"      # dumps all CI variable values to the job log
  CI_DEBUG_SERVICES: "true"   # dumps service-container logs incl. credentials

Or at job level:

deploy:
  variables:
    CI_DEBUG_TRACE: "true"
  script:
    - ./deploy.sh

Safe alternative

Remove the toggle from the committed YAML. Use the GitLab UI Run pipeline dialog to pass it as a transient variable for a single run — it will not persist in the repository.

References

• GitLab docs: Debug logging (CI_DEBUG_TRACE, CI_DEBUG_SERVICES)
• GL021: secret variable value printed to job log via echo/printf
• GL027: secret-like variable with a value committed in the pipeline file

Documentation for glsec 1.23.0. Source of this page · Rule implementation