GitLab Email Addresses Can Be Weaponized for Supply Chain Attacks

Aikido Security discovered that GitLab incoming email addresses include a reusable, non‑expiring token that can authenticate as the account owner to create issues and submit merge requests across public and private projects; exposed addresses can be abused to push code (including bypassing IP restrictions), posing supply‑chain and code‑integrity risks. Aikido reported the issue to GitLab, which updated its documentation and UI, and recommends rotating tokens and enforcing sender verification as mitigations.