{"version":"2.1.232","anchor":"gitlab-tokens-are-redacted-from-logs-and-glab-config-directo","canonical_anchor":"gitlab-tokens-are-redacted-from-logs-and-glab-config-directo","heading":"GitLab tokens are redacted from logs, and glab config directories are blocked in the sandbox","tier":"notice","area":"Sandbox","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.232\/e\/gitlab-tokens-are-redacted-from-logs-and-glab-config-directo","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.232","markdown":"### GitLab tokens are redacted from logs, and glab config directories are blocked in the sandbox\n\nGitLab tokens are masked in logs and glab config directories are blocked inside the sandbox.\n\n**What**\n\nThe secret scrubber that already masked GitHub, Slack and JWT credentials now also matches GitLab tokens (`glpat-`, `gldt-`, `glsoat-`, agent tokens and the rest of the family) and replaces them with `<token>`. Sandbox setup separately denies `.git\/glab-cli` and `.config\/glab-cli`, matching the hardening already applied to the GitHub CLI.\n\n**Details**\n\n- The denial covers the repository, its superproject and worktrees.\n- `.config\/glab-cli\/config.yml` is also listed in the sensitive-path pattern.\n\n**Evidence**\n\n`\/\\bgl(?:pat|dt|rt|ft|soat|oas|agent|ptt|cbt|imt|ffct)-[A-Za-z0-9_=-]{20,}(?:\\.[0-9a-z]{9})?\/g`\n\n- Area: Sandbox\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 2\/5"}