Publicly Listed GitLab Project Emails Open Door for Code Injection

Security researchers have identified a growing problem on GitLab: private project email addresses that enable developers to submit issues, tasks, or patches are being posted openly in documentation, allowing hostile actors to push code directly into those repositories.

These email addresses are part of GitLab's built‑in feature that accepts contributions via email. When a correctly formatted message is sent to the address, the platform can translate it into a new issue, a merge request, or even a commit, depending on the configuration.

While the feature is convenient for teams that rely on email workflows, it also creates a privileged entry point. If an attacker knows the address and the project’s visibility settings, they can craft a message that results in code being added without any additional authentication.

The exposure is not accidental. Several open‑source projects and companies have included the email address in README files, contributor guides, and support pages that solicit bug reports. Those pages are often indexed by search engines, making the addresses discoverable by anyone who searches for the project name.

Because the email channel bypasses the usual two‑factor or token‑based authentication required for web‑based pushes, malicious submissions can slip past standard access controls. In worst‑case scenarios, an attacker could introduce malicious payloads, alter existing code, or create a supply‑chain foothold that spreads to downstream users.

GitLab has not issued a formal statement at the time of writing, but the incident has prompted discussion across security forums and the platform’s community channels. Users are being urged to audit their documentation for any references to project‑specific email addresses.

Mitigation steps include disabling email‑based pushes for sensitive projects, replacing public email addresses with generic ones that route to moderated inboxes, and enforcing stricter repository permissions. Organizations are also advised to implement monitoring that flags unexpected commits originating from email sources.

The episode underscores a broader trend in software supply‑chain security: seemingly innocuous conveniences can become attack vectors when they are exposed beyond the intended audience. As developers continue to lean on collaborative platforms, careful management of all access mechanisms—including email endpoints—will be essential to preserve code integrity.