GitLab runner authentication token

Description

General

• Documentation: https://docs.gitlab.com/runner/register/#register-with-a-runner-authentication-token
• Summary: GitLab Runner provides a way to execute jobs defined in GitLab CI/CD pipelines. The authentication token is used to securely register the runner with the GitLab instance, allowing it to communicate and fetch job instructions securely.
• IPs allowlist: This feature is not available.

Revoke the secret

To revoke an API token, navigate to the GitLab project settings, then go to 'Access Tokens' where inactive or unused tokens can be removed.

Check for suspicious activity

Monitoring for any unexpected registration of runners or abnormal job execution patterns can indicate suspicious activity.

Details for Gitlab runner authentication token

• Family: token

• Category: ci_cd

• Company: GitLab

• High recall: True

• Validity check available: True

• Analyzer available: False

• On-premise instances exist: True

• Only valid secrets raise an alert: False

• Minimum number of matches: 1

• Occurrences found for one million commits: 1.35

• Prefixed: True

• PreValidators:

- type: ContentWhitelistPreValidator
  patterns:
    - glrt-

Examples

- text: |
    token=glrt-ZzoxcW92bjAKbzoxCnQ6Mgp1Omc0N2xifQl3aTfPjyn5JeQaD_CfiuN.7l55ehged
  apikey: glrt-ZzoxcW92bjAKbzoxCnQ6Mgp1Omc0N2xifQl3aTfPjyn5JeQaD_CfiuN.7l55ehged