Is It Safe to Store Sensitive Data in GitLab CI Variables?
GitLab's recent introduction of "Masked and Hidden" visibility for variables enhances security by masking sensitive data before storage. However, it's crucial to understand the underlying processes and encryption methods involved.
GitLab stores CI variables in a relational database within the ci_variables table, which includes columns for ID, key, value, protected status, and masked status. While this organization simplifies data access, it also raises concerns about vulnerability. GitLab employs AES encryption for data, which allows for decryption using the same key. This means that if an attacker gains access to the encryption key, the data is compromised.
So, is GitLab vulnerable for storing sensitive data?
Generally, no -- it's secure enough for many use cases, but not the recommended practice for highly sensitive information. A better approach is to store encrypted data externally, using tools like HashiCorp Vault, which integrates seamlessly with various services, including GitLab. Additionally, major cloud providers like AWS, Google Cloud, and Azure offer their own secret management solutions.
For further reading, check out the following resources: