The Credential You Published on Purpose: How an Exposed GitLab Email Token Becomes Push Access to Main

The report explains that GitLab's incoming-email address contains an account-level, never-expiring 'glimt-' token which, if published in public documentation, can be abused by sending an email to the -merge-request@ address with a .patch attachment to create commits (including to protected branches) and trigger CI pipelines with access to secrets; researchers found multiple live instances, GitLab labeled the behavior as intended and issued no patch, and the recommended mitigation is to reset the incoming email token, audit commits and pipelines, and remove addresses from public docs.