GitLab
Complete DevSecOps platform providing source control, CI/CD, security scanning, and project management in a single application.
https://gitlab.comMax Reward
$20,000
Total Paid
$2,700,000
Resolved
412
Avg Response
3 days
In-Scope Assets
gitlab.com
Web platform, repositories, and merge requests
GitLab API
REST and GraphQL APIs
GitLab CI/CD
Pipeline runners and container registry
GitLab Pages
Static site hosting
Out of Scope
- ✕ Self-hosted instances
- ✕ GitLab community edition
- ✕ Marketing site
Severity Levels & Rewards
RCE, authentication bypass, privilege escalation, fund extraction
Stored XSS, CSRF with impact, API abuse, data manipulation
Reflected XSS, data leakage, logic flaws, information disclosure
Verbose errors, minor config issues, low-impact info disclosure
Active Bounties (1)
| ID | Title | Severity | Status | Reward | Submissions |
|---|---|---|---|---|---|
| GL-001 | CI pipeline secret exfiltration via malicious .gitlab-ci.yml | Critical | Open | $10,000–$20,000 | 0 |
Rules of Engagement
• Do not access, modify, or delete data belonging to other users.
• Do not perform denial-of-service attacks or automated scanning at high volume.
• Report vulnerabilities promptly and provide sufficient detail to reproduce.
• Allow reasonable time for fix before public disclosure (90 days).
• Safe harbor: We will not pursue legal action against researchers acting in good faith within these rules.