Leaked GitLab PAT queried via personal_access_tokens/self endpoint

Arnold Chan@slaz

•updated Sep 10, 2026•0•0•1

Detects GitLab's personal_access_tokens/self endpoint being queried via GET, the reconnaissance step a leaked token uses to confirm its own scopes and privilege level.