Rules / GL073

GL073 Artifacts exposed to unauthenticated users (`public: true` / `access: all`)

Severity: warn (raised to error when an exposed path looks sensitive)
OWASP: CICD-SEC-6 – Insufficient Credential Hygiene

What glsec checks

glsec flags jobs whose artifacts: block makes the produced artifacts downloadable by anonymous, unauthenticated users. Two mutually exclusive keywords control this:

artifacts:public: true — the legacy keyword; artifacts are downloadable without authentication.
artifacts:access: all — values are all | developer | none; all makes artifacts publicly downloadable.

GL005 inspects which files land in artifacts; GL073 inspects who can download them. A job that produces build output, reports, or — worse — a file matching a sensitive pattern, and exposes it anonymously, is an explicit data-exposure vector.

When an exposed artifact path also matches GL005's sensitive-file patterns (.env, *.pem, *credential*, kubeconfig, *.tfstate, …) the finding is raised to error.

Trigger examples

expose_public:
  artifacts:
    public: true            # downloadable without a GitLab account
    paths:
      - build/
  script:
    - ./build.sh

expose_access_all:
  artifacts:
    access: all             # same effect via the newer keyword
    paths:
      - dist/
  script:
    - ./build.sh

expose_secret:
  artifacts:
    access: all
    paths:
      - config/credentials.json   # error: sensitive path exposed anonymously
  script:
    - ./build.sh

Safe alternative

Restrict who can download the artifacts:

build:
  artifacts:
    access: developer       # only project members; or "none" to forbid download
    paths:
      - build/
  script:
    - ./build.sh

What is not flagged

An artifacts: block with no public/access key — the default is not flagged, to avoid firing on every artifacts block.
artifacts:public: false.
artifacts:access: developer or artifacts:access: none.

References

GitLab: artifacts:public
GitLab: artifacts:access
GL005: sensitive file patterns in artifacts: paths

Documentation for glsec 1.23.0. Source of this page · Rule implementation

GL073 Artifacts exposed to unauthenticated users (public: true / access: all)