{"version":"2.1.232","anchor":"nine-more-gitlab-token-types-are-caught-by-the-secret-scanne","canonical_anchor":"nine-more-gitlab-token-types-are-caught-by-the-secret-scanne","heading":"Nine more GitLab token types are caught by the secret scanner","tier":"notice","area":"Secret Redaction","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.232\/e\/nine-more-gitlab-token-types-are-caught-by-the-secret-scanne","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.232","markdown":"### Nine more GitLab token types are caught by the secret scanner\n\nNine more GitLab token types are now caught and masked by the secret scanner.\n\n**What**\n\nThe scanner replaced its two hard-coded GitLab patterns with a shared, looser suffix match and added nine prefixes, all at high confidence: runner authentication (`glrt-`), OAuth app secret (`gloas-`), pipeline trigger (`glptt-`), Kubernetes agent (`glagent-`), incoming mail (`glimt-`), SCIM OAuth (`glsoat-`), CI build (`glcbt-`), feed (`glft-`) and feature-flag client (`glffct-`).\n\n**Details**\n\n- The shared suffix is `[\\w=-]{20,}(?:\\.[0-9a-z]{9})?`, which is broader than the previous fixed 20-character match, so longer and dotted token forms are now caught too.\n\n**Evidence**\n\n`gitlab-feature-flag-client-token`\n\n- Area: Secret Redaction\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 1\/5"}