Validate GitLab pipeline options at creation time with typed inputs
Typed inputs can reject invalid pipeline choices before jobs begin, but they are not runtime variables.
Read the guideDSE security knowledge hubSecurity knowledge,
Security knowledge,
without the noise.
Page 3 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
DSE-authoredOfficial sourcesReviewed guidance
Search the library DSE post stream
2,626 articlesGuidance and analysis from DSE
Check GitLab’s keep-latest behavior before relying on artifact expiry
An expire_in value alone does not describe the retention of every pipeline artifact.
Read the guide
Prevent a shared GitLab runner from reusing another project’s private image without a registry check
The if-not-present pull policy can cross an authorization boundary through the local image cache.
Read the guide
Explain why an approved GitLab deployment may still be waiting to run
Approval satisfies the release gate; the deployment job still requires a separate start.
Read the guide
Grant GitLab deployment-only access without broadening repository permissions
An invited Reporter group can be used for deployment access while repository write authority stays separate.
Read the guide
Review pipeline code even when GitLab variables are masked and protected
Masking changes log display; it does not make untrusted job code safe to execute with a secret.
Read the guide
Treat a GitLab job-token allowlist as a second gate, not a permission grant
Cross-project job access requires an allowed source and an already-authorized triggering user.
Read the guide
Handle pfSense OpenVPN exports as credentials, not ordinary configuration attachments
Inline and archive exports can contain the keys needed to authenticate a VPN client.
Read the guide
Choose what a pfSense gateway monitor actually proves
A responding local modem and a usable upstream internet path are different observations.
Read the guide
Keep local and VPN traffic above pfSense Multi-WAN policy-routing rules
A gateway on a broad pass rule can send traffic away from routes that should remain local.
Read the guide