GitLab Projects API queried with membership=true for enumeration

Arnold Chan@slaz

•updated Sep 10, 2026•0•0•2

Detects anomalous GitLab project enumeration where an account performs an excessive number of requests to the Projects API using the 'membership=true' parameter within a one-hour window. This behavior is indicative of an attacker attempting to discover all accessible repositories associated with a compromised or over-privileged GitLab token.