lolcreds

Public credential defaults and exposure patterns for authorized security testing.

GitLab

GitLabCI/CD4 credentials

Credentials4 documented
01

GitLab User / Administrator Password

gitlab / user-or-admin-password

GitLab users, administrators, service accounts, or break-glass accounts may authenticate to product consoles, CLIs, APIs, SSO flows, or associated integrations with user-defined passwords or federated login flows.

user definedgenerated on installsecretusername/password

Location

public interface
GitLab web console, admin portal, CLI login, API login, or SSO/OAuth authorization endpoint
secret store

password managers, enterprise IdP stores, break-glass admin vaults, CI/CD variables, and managed credential stores

config file

SSO connector configs, local CLI profiles, application settings, scripts, and integration definitions

logs

audit logs, sign-in logs, admin events, access logs, CLI debug output, and support traces

Notes

Catalogs ordinary operational credential locations; this is not a claim of a static vendor default password.

02

GitLab Product API Token / Key

gitlab / product-api-token-or-key

GitLab exposes product API credentials represented in Betterleaks detector coverage (gitlab-cicd-job-token, gitlab-deploy-token, gitlab-feature-flag-client-token, gitlab-feed-token, gitlab-incoming-mail-token, gitlab-kubernetes-agent-token, gitlab-oauth-app-secret, gitlab-pat, gitlab-pat-routable, gitlab-pat-routable-versioned, gitlab-ptt, gitlab-rrt, gitlab-runner-authentication-token, gitlab-runner-authentication-token-routable, gitlab-scim-token, gitlab-session-cookie). These credentials commonly authorize account, workspace, project, or integration-level API operations.

generated on installuser definedsecrettoken

Looks like

example
example

GitLab personal/project/group/impersonation token prefix

glpat-0123456789abcdef0123
example

GitLab deploy token prefix

gldt-0123456789abcdef0123
example

GitLab runner authentication token prefix

glrt-0123456789abcdef0123
example

GitLab CI/CD job token prefix

glcbt-0123456789abcdef0123
example

GitLab pipeline trigger token prefix

glptt-0123456789abcdef0123
example

GitLab feed token prefix

glft-0123456789abcdef0123
example

GitLab incoming mail token prefix

glimt-0123456789abcdef0123

Location

http header
Authorization

Bearer, Basic, API-key, or product-specific authorization header used by SDKs and API clients

http response

token, key, OAuth, webhook, or credential creation responses where the product displays the secret value once

config file
~/.python-gitlab.cfg, .gitlab-ci.yml, config.toml, glab-cli/config.yml

GitLab CLI/SDK config, CI config, and runner config files

environment
GITLAB_TOKEN, GITLAB_ACCESS_TOKEN, GITLAB_API_TOKEN, GL_TOKEN, GITLAB_PRIVATE_TOKEN
secret store

CI/CD variables, cloud secret managers, platform secret stores, password vaults, and integration vaults

source code

application code, automation scripts, notebooks, tests, examples, infrastructure-as-code, and committed config files

logs

API debug logs, CLI traces, webhook/integration logs, CI output, exception traces, and support bundles

Notes

Betterleaks detector rule IDs covered by this product entry: gitlab-cicd-job-token, gitlab-deploy-token, gitlab-feature-flag-client-token, gitlab-feed-token, gitlab-incoming-mail-token, gitlab-kubernetes-agent-token, gitlab-oauth-app-secret, gitlab-pat, gitlab-pat-routable, gitlab-pat-routable-versioned, gitlab-ptt, gitlab-rrt, gitlab-runner-authentication-token, gitlab-runner-authentication-token-routable, gitlab-scim-token, gitlab-session-cookie. This block is product-focused; generic token/JWT/private-key handling stays in the consuming product context.

03

GitLab OAuth / Application Credential

gitlab / oauth-application-credential

GitLab OAuth apps, marketplace apps, service principals, integrations, or installed applications can use client IDs, client secrets, access tokens, refresh tokens, and app installation credentials.

generated on installuser definedsecretsecret value

Looks like

example
example

GitLab OAuth application secret prefix from GitLab token docs

gloas-0123456789abcdef0123

Location

http header
Authorization

Bearer access token or Basic client authentication

http response

OAuth token responses containing access_token, refresh_token, id_token, token_type, scope, and expiry fields

config file
gitlab-oauth.json, oauth.json, config.yml

OAuth app configs, SDK settings, integration manifests, .env files, callback handlers, and service configs; Removed generic/common scanner surface path(s) from product template: .env

environment
GITLAB_CLIENT_SECRET, GITLAB_ACCESS_TOKEN, GITLAB_REFRESH_TOKEN

OAuth client secret and token env vars; client ID is context, not secret material

secret store

OAuth client secret stores, CI/CD variables, cloud secret managers, enterprise vaults, and app-installation secret stores

source code

OAuth callback code, app manifests, automation scripts, test fixtures, and examples

logs

OAuth exchange logs, callback logs, API traces, and failed auth errors

04

GitLab CI/CD Runner, Deploy, or Automation Secret

gitlab / ci-cd-runner-and-deploy-secret

GitLab can store runner registration tokens, deploy keys, repository tokens, package publishing credentials, webhook secrets, and automation variables used by builds and deployments.

generated on installuser definedsecretsecret value

Location

config file
.gitlab-ci.yml, config.toml, deploy-token.json, package-credentials.json

Pipeline YAML, runner configs, deploy-token/package configs, and deployment manifests

environment
GITLAB_TOKEN, GITLAB_API_TOKEN, GITLAB_DEPLOY_TOKEN, GITLAB_PASSWORD
secret store

CI/CD secret variables, project/org secret stores, package registry secrets, cloud secret managers, and vaults

source code

pipeline definitions, build scripts, Dockerfiles, release scripts, and committed examples

artifact

build artifacts, runner workdirs, caches, release bundles, and support bundles

logs

pipeline logs, runner logs, deployment logs, package publish output, and CLI debug traces

Scope

Authorized use

LOLCreds helps map the credential surface of real products: known defaults, generated values, credential locations, and exposure patterns.