0

Your cart

TOTAL excl.
TOTAL incl.
Pay
Go back

GitLab CI/CD under attack: stolen secrets, hijacked pipelines, resilient defenses

REXCI/CDDevSecOpsGovernanceOpen Source

2026-12-09 | 02:55 PM - 03:25 PM

Information

Is your GitLab CI/CD pipeline really more reliable than the application it deploys?
Based on two realistic attack scenarios, exfiltration of secrets via CI variables and compromise via malicious merge request, this session shows how common bad configurations can be exploited, and how to put in place durable protections without slowing down teams.

CI/CD has become a critical component of the IS. Yet, on GitLab, it still too often involves sensitive variables, excessive permissions, and risky execution rules.

We will start with concrete cases observed in production:
  • exploitation of poorly protected CI variables to exfiltrate secrets and tokens;
  • compromising a pipeline via a merge request, up to the publication of corrupted artifacts.
Based on three years spent securing GitLab pipelines in production, we will demonstrate what stands the test of time:
  • settings that actually reduce the exposure area;
  • governance rules that prevent abuses without blocking teams;
  • continuous monitoring mechanisms to detect deviations before they become critical.
Are you part of the Dev, Ops, or Security team? We'll see how to rethink GitLab CI/CD security as a living system: less based on one-off audits, more on sustainable, measurable safeguards that are compatible with the reality of the teams.

Speakers