CI/CD variables (project- or group-scoped) should set masked = true. Masked variables are redacted in CI job logs (replaced with [MASKED]) preventing accidental disclosure of secrets via CI output that may be retained in artifacts or shipped to log-aggregation systems. Note: GitLab requires masked values to satisfy a length/character-class constraint (>= 8 chars, no whitespace, base64-safe).
1. Go to project Settings > CI/CD > Variables (or group equivalent). 2. For each secret variable, click Edit and toggle Mask variable. 3. If the value fails the masking constraint, regenerate the secret with a base64-safe value of >= 8 characters.
{
"target": "GLCiVariable",
"if": {
"allOf": [
{
"resource": "GLCiVariable",
"property": "Masked",
"operator": "equals",
"value": true
}
]
},
"then": {
"effect": "Audit"
}
}Copyright © DevOps Shield. All Rights Reserved. Privacy Policy | Cookie Policy | Terms and Conditions | v1.0.2