GitLab CI artifact config exposes files via untracked:true retention

Arnold Chan@slaz

•updated Sep 10, 2026•0•0•2

Detects GitLab CI/CD pipeline configuration (.gitlab-ci.yml) that sets job artifacts to 'untracked: true' with 'when: always', which publishes every untracked file as a downloadable CI artifact -- the exact misconfiguration that exposed the leaked GitLab token in the GnuTLS incident.