Grant GitLab deployment-only access without broadening repository permissions
An invited Reporter group can be used for deployment access while repository write authority stays separate.
Read the guideDSE security knowledge hubCybersecurity
Cybersecurity
Knowledge
Page 3 of the DSE Cybersecurity knowledge center, with source-backed guidance and practical next steps.
DSE-authoredOfficial sourcesReviewed guidance
Search the library Explore this topic
Start with the cornerstone guide Cybersecurity knowledge center
Source-backed guidance for identity, vulnerability reduction, ransomware readiness, detection, response, and recovery.
DSE post stream
1,658 articlesCybersecurity
Review pipeline code even when GitLab variables are masked and protected
Masking changes log display; it does not make untrusted job code safe to execute with a secret.
Read the guide
Treat a GitLab job-token allowlist as a second gate, not a permission grant
Cross-project job access requires an allowed source and an already-authorized triggering user.
Read the guide
Handle pfSense OpenVPN exports as credentials, not ordinary configuration attachments
Inline and archive exports can contain the keys needed to authenticate a VPN client.
Read the guide
Protect the pfSense pfsync network as a state-table trust boundary
pfsync state exchange has no built-in authentication, so the network carrying it matters.
Read the guide
Check resolved addresses before using a pfSense hostname alias for a public service
A DNS-backed firewall alias is a periodically refreshed address set, not a hostname-aware web filter.
Read the guide
Review required OIDC claims before connecting a SaaS application through Cloudflare Access
A missing required claim can block authentication even after the user signs in successfully.
Read the guide
Do not equate Cloudflare’s WARP posture check with enrollment in your organization
The documented WARP check also accepts the consumer client.
Read the guide
Keep Access client-certificate trust separate from the website server certificate
The CA uploaded for Access mTLS validates clients, not the certificate shown by the website.
Read the guide
Separate Access authentication evidence from HTTP activity evidence
A successful login record does not list every action taken inside an application.
Read the guide