GitLab Email Tokens Exposed in Public Docs

Aikido researchers found a dozen live GitLab incoming email addresses in public READMEs and support pages. Each embeds a persistent glimt- token that lets anyone create issues or merge requests as the owner, bypassing IP restrictions. Attackers could push code to protected branches or steal secrets. GitLab closed the May report as intended behavior, then updated its UI in June.