GitLab API token used from multiple/anomalous source IPs

Arnold Chan@slaz

•updated Sep 10, 2026•0•0•0

Detects a GitLab personal access token used from multiple distinct source IPs or from IPs associated with the leaked gitlab-triage token, inconsistent with expected CI runner infrastructure.