gitlab-triage automation using overly broad 'api'-scoped token

Arnold Chan@slaz

•updated Sep 10, 2026•0•0•1

Detects the gitlab-triage automation tool being invoked with a personal access token scoped to the broad 'api' permission rather than a narrower issue/MR-only scope, inflating the blast radius if the token leaks.