GitLab data sharing & exposure security checks
External sharing, public links, guest access, retention and data-protection settings that quietly push company data outside the tenant.
On GitLab, Black Cat runs 5 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the GitLab connector needs.
Checks (5)
severity: high Group Public Visibility fix difficulty: easy #
Change GitLab group visibility from Public to Private or Internal
- Navigate to GitLab Group Settings > General > Visibility, project features, permissions
- Change the group visibility to 'Private' or 'Internal'
- Review subgroup and project visibility settings
Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-28.3 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.12
severity: medium Group Sharing Unlocked fix difficulty: easy #
Enable Share with group lock in GitLab to prevent projects from being shared outside the group
- Navigate to Group > Settings > General > Permissions
- Enable Share with group lock
- Save changes
- Review existing project shares
Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-28.3 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.12
severity: high Group Forking Allowed Outside fix difficulty: easy #
Prevent project forking outside the GitLab group to protect source code
- Navigate to Group > Settings > General > Permissions
- Enable Prevent project forking outside the group
- Save changes
- Review existing forks for unauthorized copies
Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-28.3 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.12
severity: high Group Sharing Outside Organization fix difficulty: easy #
Prevent GitLab groups from being shared outside the organization hierarchy
- Navigate to Group > Settings > General > Permissions
- Enable Prevent sharing groups outside the hierarchy
- Save changes
- Audit existing group shares
Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-28.3 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.12
severity: medium Public Project fix difficulty: easy #
Review public GitLab projects and change visibility to Private or Internal if they contain sensitive code
- Review whether the project should be public
- Change visibility to 'Private' or 'Internal' if it contains sensitive code
- If it must be public, ensure no secrets or credentials are in the repository
Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-44.1 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.12