GitLab Runner Registration Token detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_SECRET_371
Category	Secrets
Severity	CRITICAL
Framework	Git

Impact

GitLab Runner registration tokens are used to register new runners with GitLab CI/CD. If exposed, attackers could register malicious runners to your GitLab instance, potentially executing unauthorized code in your CI/CD pipelines, stealing secrets, or compromising your build artifacts. Reset the token immediately and audit runner registrations.

How to Fix

Reset the GitLab Runner registration token immediately. Review and remove any unauthorized runners. Implement IP restrictions and use project-specific tokens where possible.