GitLab Pipeline Trigger Token
Detects GitLab pipeline trigger tokens (glptt- prefix). These tokens let external systems start CI/CD pipelines via the trigger API; a leak allows unauthorized pipeline execution.
- Type
- regex
- Engine
- universal
- Confidence
- high
- Confidence justification
- High confidence: the distinctive glptt- prefix with a fixed 40-character hex body makes false positives extremely unlikely.
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth), Computer Fraud and Abuse Act, Computer Misuse Act 1990
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
- Data categories
- credentials, security
- Scope
- narrow
- Risk rating
- 8
- Platform compatibility
- Purview: Compatible, GCP DLP: Unsupported, Macie: Unsupported, Zscaler: Compatible, Palo Alto: Unsupported, Netskope: Unsupported
Pattern
(?<![A-Za-z0-9_-])glptt-[0-9a-f]{40}(?![A-Za-z0-9_-])Corroborative evidence keywords
gitlab, pipeline trigger, trigger token, CI/CD, trigger pipeline
Proximity: 300 characters
Should match
glptt-0123456789abcdef0123456789abcdef01234567— Exact 65 probe - fixed hexadecimal token without independent GitLab contextGitLab pipeline trigger credential glptt-deadbeefdeadbeefdeadbeefdeadbeefdeadbeef— Exact 75 probe - token with GitLab pipeline-trigger contextGitLab CI pipeline secret GITLAB_TRIGGER_TOKEN=glptt-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa— Exact 85 probe - CI pipeline context plus canonical trigger assignment
Should not match
glptt-0123456789abcdef— Too short to be a pipeline trigger tokenglpat-ABCDEFGHIJ1234567890— GitLab PAT prefix, not a pipeline trigger tokenglrt-ABCDEFGHIJ1234567890— GitLab runner token is a sibling family, not a trigger tokenDocumentation example: GitLab CI pipeline GITLAB_TRIGGER_TOKEN=glptt-0123456789abcdef0123456789abcdef01234567— Documentation example containing a valid-shaped trigger token is excludedregenerate the gitlab pipeline trigger token in settings— Prose mention without a token value
Known false positives
- 40-char hex digests (e.g. SHA-1) accidentally prefixed with glptt- in documentation. Mitigation: Require corroborative GitLab CI/CD keywords and exclude placeholder markers.