Skip to content

Scan

pipeleek gl release scan

Scan GitLab release assets for secrets

Synopsis

Scan linked assets of published GitLab releases for secrets. By default, scan all releases of all token-visible projects, including HTTP(S) assets hosted outside GitLab. Downloads send the token only to the configured GitLab origin; external assets and redirects do not receive it. Use --include-sources to also scan one generated source ZIP per release.

Assets exceeding --max-artifact-size (downloaded bytes) are skipped. Extracted archive sizes are not limited. Other coverage failures are reported while scanning continues, with a nonzero exit. --member applies to global project discovery; --owned and --search also apply within --namespace, including subgroups. --repo takes precedence over list filters.

1
pipeleek gl release scan [flags]

Examples

1
2
3
4
5
6
7
8
# Scan all visible projects' release assets
pipeleek gl release scan --url https://gitlab.example.com --token [redacted]

# Scan one release, including its generated source ZIP
pipeleek gl release scan --url https://gitlab.example.com --token [redacted] --repo group/project --tag v1.0 --include-sources

# Scan the newest five published releases per project in a namespace
pipeleek gl release scan --url https://gitlab.example.com --token [redacted] --namespace group --release-limit 5

Options

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
      --confidence strings         Filter for confidence level, separate by comma if multiple. See readme for more info.
  -h, --help                       help for scan
      --hit-timeout duration       Maximum time to wait for hit detection per scan item (e.g., 30s, 2m, 1h) (default 2m0s)
      --include-sources            Also scan one generated source ZIP per release
      --max-artifact-size string   Maximum downloaded bytes per asset; extracted archive sizes are not limited (default "500Mb")
  -m, --member                     Scan projects the user is a member of (global project discovery)
  -n, --namespace string           Namespace to scan, including subgroup projects
  -o, --owned                      Scan only user owned repositories
      --release-limit int          Maximum published releases per project, newest first; 0 scans all
  -r, --repo string                Single repository to scan, format: namespace/repo
  -s, --search string              Query string for searching projects
      --secrets-verification       Verify supported credentials with their providers (enabled by default, disable with --secrets-verification=false) (default true)
      --tag string                 Exact release tag to scan (requires --repo)
      --threads int                Number of concurrent threads for scanning (default 4)
      --webui                      Serve a local web UI for live findings on 127.0.0.1 with a random token

Options inherited from parent commands

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
      --color                   Enable colored log output (auto-disabled when using --logfile) (default true)
      --config string           Config file path. Example: ~/.config/pipeleek/pipeleek.yaml
      --http-timeout duration   HTTP request timeout, e.g. 30s or 2m (default: no timeout)
      --ignore-proxy            Ignore HTTP_PROXY environment variable
      --json                    Use JSON as log output format
      --log-level string        Set log level globally (debug, info, warn, error). Example: --log-level=warn
  -l, --logfile string          Log output to a file
      --proxy string            Proxy URL, e.g. http://127.0.0.1:8080 or socks5://127.0.0.1:1080 (takes precedence over HTTP_PROXY)
      --tls-verification        Enable TLS certificate verification (by default verification is skipped to support self-signed certificates)
  -t, --token string            GitLab API Token
  -u, --url string              GitLab instance URL
  -v, --verbose                 Enable debug logging (shortcut for --log-level=debug)

SEE ALSO