Private email addresses that let developers push issues or tasks to GitLab projects are being deliberately exposed in public documentation, such as READMEs, contributing guides and support pages that collect bug reports.
These addresses are used by GitLab to allow contributors to submit code and issue updates directly to a repository. When a developer sends an email to one of these addresses, the platform automatically creates a new issue or commits the attached code.
Security researchers have found that the addresses are listed openly in several GitLab project files and help pages. The information is not hidden behind authentication or other controls, making it easy for anyone to locate and use.
Because the addresses grant write access to the project, an attacker who obtains them could potentially push malicious code or create spam issues. The exposure therefore represents a significant security risk for any organisation that relies on GitLab for its development workflow.
Project maintainers are advised to remove or obfuscate these email addresses from public documentation and to enable stricter access controls on their repositories. For more details, see the Bleeping Computer report on the issue.
<small>Source: Bleeping Computer — read the original story there.</small>
