Check GitLab’s keep-latest behavior before relying on artifact expiry
An expire_in value alone does not describe the retention of every pipeline artifact.
Read the guideDSE security knowledge hubIT
IT
Knowledge
Page 2 of the DSE IT knowledge center, with source-backed guidance and practical next steps.
DSE-authoredOfficial sourcesReviewed guidance
Search the library Explore this topic
Start with the cornerstone guide IT knowledge center
Production-minded guidance for endpoints, servers, updates, cloud services, administration, and supportable operations.
DSE post stream
1,297 articlesIT
Prevent a shared GitLab runner from reusing another project’s private image without a registry check
The if-not-present pull policy can cross an authorization boundary through the local image cache.
Read the guide
Explain why an approved GitLab deployment may still be waiting to run
Approval satisfies the release gate; the deployment job still requires a separate start.
Read the guide
Grant GitLab deployment-only access without broadening repository permissions
An invited Reporter group can be used for deployment access while repository write authority stays separate.
Read the guide
Review pipeline code even when GitLab variables are masked and protected
Masking changes log display; it does not make untrusted job code safe to execute with a secret.
Read the guide
Treat a GitLab job-token allowlist as a second gate, not a permission grant
Cross-project job access requires an allowed source and an already-authorized triggering user.
Read the guide
Keep local and VPN traffic above pfSense Multi-WAN policy-routing rules
A gateway on a broad pass rule can send traffic away from routes that should remain local.
Read the guide
Read both NAT addresses and both directions in the pfSense state table
The state table can distinguish a translated connection from one that has not received a reply.
Read the guide
Separate Access authentication evidence from HTTP activity evidence
A successful login record does not list every action taken inside an application.
Read the guide
Validate the Access audience and rotating signing keys at a Cloudflare-protected origin
A forwarded identity header becomes trustworthy only after the intended token is verified.
Read the guide