GitLab Runner Authentication Token

Name: GitLab Runner Authentication Token
Creator: TestPattern Community
License: https://opensource.org/licenses/MIT

Detects GitLab runner authentication tokens (glrt- prefix). These tokens authenticate a CI/CD runner to a GitLab instance; a leak lets an attacker impersonate a runner and capture job payloads.

Type: regex
Engine: universal
Confidence: high
Confidence justification: High confidence: the distinctive glrt- prefix with a fixed 20-character body makes false positives extremely unlikely.
Jurisdictions: global
Regulations: Criminal Code Act 1995 (Cth), Computer Fraud and Abuse Act, Computer Misuse Act 1990
Frameworks: CIS Controls, ISO 27001, NIST CSF, SOC 2
Data categories: credentials, security
Scope: narrow
Risk rating: 8
Platform compatibility: Purview: Compatible, GCP DLP: Unsupported, Macie: Unsupported, Zscaler: Compatible, Palo Alto: Unsupported, Netskope: Unsupported

Pattern

(?<![A-Za-z0-9_-])glrt-[A-Za-z0-9_-]{20}(?![A-Za-z0-9_-])

Corroborative evidence keywords

gitlab, runner, runner authentication, gitlab-runner, CI/CD

Proximity: 300 characters

Should match

glrt-ABCDEFGHIJ1234567890 — Exact 65 probe - runner-token structure without independent GitLab context
GitLab runner registration credential glrt-aB3dE6gH9jK2mN5pQ8sT — Exact 75 probe - token with GitLab runner context
GitLab CI runner secret CI_SERVER_TOKEN=glrt-zZyYxXwWvVuU01234567 — Exact 85 probe - runner context plus canonical authentication assignment

Should not match

glrt-tooShort — Too short to be a runner authentication token
glpat-ABCDEFGHIJ1234567890 — GitLab PAT prefix, not a runner token
gldt-ABCDEFGHIJ1234567890 — GitLab deploy token is a sibling family, not a runner token
Documentation example: GitLab CI runner CI_SERVER_TOKEN=glrt-ABCDEFGHIJ1234567890 — Documentation example containing a valid-shaped runner token is excluded
register the gitlab runner with a fresh authentication token — Prose mention without a token value

Known false positives

Documentation or examples showing placeholder glrt- strings. Mitigation: Require corroborative GitLab runner keywords and exclude placeholder markers.

References

Collections

Cloud Credentials & API Keys